Edit tour

Windows Analysis Report
TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Overview

General Information

Sample name:	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe (renamed file extension from bin to exe)
Original sample name:	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.bin
Analysis ID:	1559772
MD5:	fb652b5ff3a97ebbb8c9bf69c7010c1c
SHA1:	49acdeb895d801dd4439fad35337b19baca56d65
SHA256:	4d37f7aea76ccb788710e7d3a8d2553964142a835115a9f0768f33b286400352
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops large PE files

Injects a PE file into a foreign processes

Installs a global keyboard hook

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w7x64

TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe (PID: 3320 cmdline: "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe" MD5: FB652B5FF3A97EBBB8C9BF69C7010C1C)

TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe (PID: 3444 cmdline: "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe" MD5: FB652B5FF3A97EBBB8C9BF69C7010C1C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["alfredoperezpu1405.con-ip.com:2500:1", "alfredoperezpu1405.con-ip.com:1663:1"], "Assigned name": "PRAGAA", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-NK89SF", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000000.352200957.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.405329214.0000000002630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x6650c:$str_a1: C:\Windows\System32\cmd.exe 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6657c:$str_b2: Executing file: 0x675fc:$str_b3: GetDirectListeningPort 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67128:$str_b7: \update.vbs 0x665a4:$str_b9: Downloaded file: 0x66590:$str_b10: Downloading file: 0x66634:$str_b12: Failed to upload file: 0x675c4:$str_b13: StartForward 0x675e4:$str_b14: StopForward 0x67080:$str_b15: fso.DeleteFile " 0x67014:$str_b16: On Error Resume Next 0x670b0:$str_b17: fso.DeleteFolder " 0x66624:$str_b18: Uploaded file: 0x665e4:$str_b19: Unable to delete: 0x67048:$str_b20: while fso.FileExists(" 0x66ac1:$str_c0: [Firefox StoredLogins not found]
00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6638c:$s1: CoGetObject 0x663a0:$s1: CoGetObject 0x663bc:$s1: CoGetObject 0x7035e:$s1: CoGetObject 0x6634c:$s2: Elevation:Administrator!new:
00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aec2:$a1: Remcos restarted by watchdog! 0x6b43a:$a3: %02i:%02i:%02i:%03i
Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xf3f78:$a1: Remcos restarted by watchdog! 0xffc24:$a1: Remcos restarted by watchdog! 0xf44d1:$a3: %02i:%02i:%02i:%03i 0xf4900:$a3: %02i:%02i:%02i:%03i 0x10017e:$a3: %02i:%02i:%02i:%03i 0x1005ad:$a3: %02i:%02i:%02i:%03i
Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3444	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2630000.2.raw.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab8:$a1: Remcos restarted by watchdog! 0x6b030:$a3: %02i:%02i:%02i:%03i
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64b0c:$str_a1: C:\Windows\System32\cmd.exe 0x64a88:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a88:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f88:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b7c:$str_b2: Executing file: 0x65bfc:$str_b3: GetDirectListeningPort 0x655a8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65728:$str_b7: \update.vbs 0x64ba4:$str_b9: Downloaded file: 0x64b90:$str_b10: Downloading file: 0x64c34:$str_b12: Failed to upload file: 0x65bc4:$str_b13: StartForward 0x65be4:$str_b14: StopForward 0x65680:$str_b15: fso.DeleteFile " 0x65614:$str_b16: On Error Resume Next 0x656b0:$str_b17: fso.DeleteFolder " 0x64c24:$str_b18: Uploaded file: 0x64be4:$str_b19: Unable to delete: 0x65648:$str_b20: while fso.FileExists(" 0x650c1:$str_c0: [Firefox StoredLogins not found]
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6498c:$s1: CoGetObject 0x649a0:$s1: CoGetObject 0x649bc:$s1: CoGetObject 0x6e95e:$s1: CoGetObject 0x6494c:$s2: Elevation:Administrator!new:
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab8:$a1: Remcos restarted by watchdog! 0x6b030:$a3: %02i:%02i:%02i:%03i
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64b0c:$str_a1: C:\Windows\System32\cmd.exe 0x64a88:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a88:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f88:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b7c:$str_b2: Executing file: 0x65bfc:$str_b3: GetDirectListeningPort 0x655a8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65728:$str_b7: \update.vbs 0x64ba4:$str_b9: Downloaded file: 0x64b90:$str_b10: Downloading file: 0x64c34:$str_b12: Failed to upload file: 0x65bc4:$str_b13: StartForward 0x65be4:$str_b14: StopForward 0x65680:$str_b15: fso.DeleteFile " 0x65614:$str_b16: On Error Resume Next 0x656b0:$str_b17: fso.DeleteFolder " 0x64c24:$str_b18: Uploaded file: 0x64be4:$str_b19: Unable to delete: 0x65648:$str_b20: while fso.FileExists(" 0x650c1:$str_c0: [Firefox StoredLogins not found]
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6498c:$s1: CoGetObject 0x649a0:$s1: CoGetObject 0x649bc:$s1: CoGetObject 0x6e95e:$s1: CoGetObject 0x6494c:$s2: Elevation:Administrator!new:
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690b8:$a1: Remcos restarted by watchdog! 0x69630:$a3: %02i:%02i:%02i:%03i
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x6310c:$str_a1: C:\Windows\System32\cmd.exe 0x63088:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63088:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63588:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63db8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6317c:$str_b2: Executing file: 0x641fc:$str_b3: GetDirectListeningPort 0x63ba8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d28:$str_b7: \update.vbs 0x631a4:$str_b9: Downloaded file: 0x63190:$str_b10: Downloading file: 0x63234:$str_b12: Failed to upload file: 0x641c4:$str_b13: StartForward 0x641e4:$str_b14: StopForward 0x63c80:$str_b15: fso.DeleteFile " 0x63c14:$str_b16: On Error Resume Next 0x63cb0:$str_b17: fso.DeleteFolder " 0x63224:$str_b18: Uploaded file: 0x631e4:$str_b19: Unable to delete: 0x63c48:$str_b20: while fso.FileExists(" 0x636c1:$str_c0: [Firefox StoredLogins not found]
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62ff8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f8c:$s1: CoGetObject 0x62fa0:$s1: CoGetObject 0x62fbc:$s1: CoGetObject 0x6cf5e:$s1: CoGetObject 0x62f4c:$s2: Elevation:Administrator!new:
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x6650c:$str_a1: C:\Windows\System32\cmd.exe 0x66488:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66488:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66988:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671b8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6657c:$str_b2: Executing file: 0x675fc:$str_b3: GetDirectListeningPort 0x66fa8:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67128:$str_b7: \update.vbs 0x665a4:$str_b9: Downloaded file: 0x66590:$str_b10: Downloading file: 0x66634:$str_b12: Failed to upload file: 0x675c4:$str_b13: StartForward 0x675e4:$str_b14: StopForward 0x67080:$str_b15: fso.DeleteFile " 0x67014:$str_b16: On Error Resume Next 0x670b0:$str_b17: fso.DeleteFolder " 0x66624:$str_b18: Uploaded file: 0x665e4:$str_b19: Unable to delete: 0x67048:$str_b20: while fso.FileExists(" 0x66ac1:$str_c0: [Firefox StoredLogins not found]
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663f8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6638c:$s1: CoGetObject 0x663a0:$s1: CoGetObject 0x663bc:$s1: CoGetObject 0x7035e:$s1: CoGetObject 0x6634c:$s2: Elevation:Administrator!new:
0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2630000.2.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0.0.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ProcessId: 3320, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ZentimoDesignerEditor

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ProcessId: 3444, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["alfredoperezpu1405.con-ip.com:2500:1", "alfredoperezpu1405.con-ip.com:1663:1"], "Assigned name": "PRAGAA", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-NK89SF", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Multi AV Scanner detection for submitted file

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

ReversingLabs: Detection: 48%

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3444, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_bf76706f-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: alfredoperezpu1405.con-ip.com
Source: Malware configuration extractor	URLs: alfredoperezpu1405.con-ip.com

Source: global traffic

DNS traffic detected: DNS query: alfredoperezpu1405.con-ip.com

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://www.indyproject.org/
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://www.safelyremove.com
Source: ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/allVersions.htmP
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/allVersions.htmU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/blog/how-to-use-skins/
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/blog/how-to-use-skins/U
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/common/convert-license-key-svc?key=
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/common/userdebugreport.phpU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/download.htm?sm=CrackedVer_WrArch
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/download.htm?sm=ServiceWrArch
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/download.htm?sm=ServiceWrVerU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/enterkey.htm?sm=regform
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/enterkey.htmU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/order.htm
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/readaboutpro.htmU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/restoreLicKey.htm?sm=regformU
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	String found in binary or memory: http://zentimo.com/versioninfo/vernew.htm?

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Jump to behavior

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3444, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Drops large PE files

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

File dump: ZentimoVideo.exe.0.dr 977447173

Jump to dropped file

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005264C0 NtQueryDefaultLocale,	0_2_005264C0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524F44 NtQueryDefaultLocale,	0_2_00524F44
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00526806 NtQueryDefaultLocale,	0_2_00526806
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005264F8 NtQueryDefaultLocale,	0_2_005264F8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524CE8 NtQueryDefaultLocale,	0_2_00524CE8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525D4F NtQueryDefaultLocale,	0_2_00525D4F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525D76 NtQueryDefaultLocale,	0_2_00525D76
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525992 NtQueryDefaultLocale,	0_2_00525992
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525DB1 NtQueryDefaultLocale,	0_2_00525DB1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524DB7 NtQueryDefaultLocale,	0_2_00524DB7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524A5E NtQueryDefaultLocale,	0_2_00524A5E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524A6F NtQueryDefaultLocale,	0_2_00524A6F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052522E NtQueryDefaultLocale,	0_2_0052522E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524EF8 NtQueryDefaultLocale,	0_2_00524EF8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524284 NtQueryDefaultLocale,	0_2_00524284
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005256BC NtQueryDefaultLocale,	0_2_005256BC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525AAB NtQueryDefaultLocale,	0_2_00525AAB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005262AE NtQueryDefaultLocale,	0_2_005262AE
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525BCC NtQueryDefaultLocale,	0_2_00525BCC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524794 NtQueryDefaultLocale,	0_2_00524794
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525FAB NtQueryDefaultLocale,	0_2_00525FAB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BADE5D NtCreateThreadEx,	0_2_00BADE5D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAE15A NtCreateThreadEx,	0_2_00BAE15A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BADABC NtCreateThreadEx,	0_2_00BADABC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAD631 NtCreateThreadEx,	0_2_00BAD631
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAD677 NtCreateThreadEx,	0_2_00BAD677

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005264C0	0_2_005264C0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052CA3B	0_2_0052CA3B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524F44	0_2_00524F44
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052C44C	0_2_0052C44C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00527860	0_2_00527860
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052A46B	0_2_0052A46B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00528C06	0_2_00528C06
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00529824	0_2_00529824
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005264F8	0_2_005264F8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052D0B7	0_2_0052D0B7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005290A6	0_2_005290A6
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00527D71	0_2_00527D71
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052B57C	0_2_0052B57C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00523D1B	0_2_00523D1B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052A12F	0_2_0052A12F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525DB1	0_2_00525DB1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524DB7	0_2_00524DB7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052D1BE	0_2_0052D1BE
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00528A71	0_2_00528A71
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052B2F5	0_2_0052B2F5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524284	0_2_00524284
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005256BC	0_2_005256BC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525AAB	0_2_00525AAB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005262AE	0_2_005262AE
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052CEAC	0_2_0052CEAC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052BB50	0_2_0052BB50
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052C35B	0_2_0052C35B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00528F59	0_2_00528F59
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00527B00	0_2_00527B00
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525BCC	0_2_00525BCC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00524794	0_2_00524794
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00523F87	0_2_00523F87
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0052B7B2	0_2_0052B7B2
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_005283AB	0_2_005283AB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00525FAB	0_2_00525FAB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B60D45	0_2_00B60D45
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B64B41	0_2_00B64B41
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61CB2	0_2_00B61CB2
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B634A0	0_2_00B634A0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62495	0_2_00B62495
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61899	0_2_00B61899
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B620F3	0_2_00B620F3
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B634EC	0_2_00B634EC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B620CF	0_2_00B620CF
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61C3A	0_2_00B61C3A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61C2D	0_2_00B61C2D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62018	0_2_00B62018
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63C19	0_2_00B63C19
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62001	0_2_00B62001
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62473	0_2_00B62473
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62C65	0_2_00B62C65
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B629B5	0_2_00B629B5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61DB2	0_2_00B61DB2
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B615BE	0_2_00B615BE
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B639BD	0_2_00B639BD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B619A1	0_2_00B619A1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B625AA	0_2_00B625AA
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6219B	0_2_00B6219B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63D85	0_2_00B63D85
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B615E6	0_2_00B615E6
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B641E7	0_2_00B641E7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B619E2	0_2_00B619E2
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B631ED	0_2_00B631ED
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63DD2	0_2_00B63DD2
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B621D1	0_2_00B621D1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B631D1	0_2_00B631D1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B621DC	0_2_00B621DC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B629DD	0_2_00B629DD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B659DA	0_2_00B659DA
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B625C6	0_2_00B625C6
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B611C5	0_2_00B611C5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B631CC	0_2_00B631CC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62532	0_2_00B62532
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6210C	0_2_00B6210C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62175	0_2_00B62175
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6117E	0_2_00B6117E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6255F	0_2_00B6255F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61E84	0_2_00B61E84
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61E81	0_2_00B61E81
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6368A	0_2_00B6368A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63AF7	0_2_00B63AF7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61AF0	0_2_00B61AF0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61AFD	0_2_00B61AFD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B636F9	0_2_00B636F9
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63AD9	0_2_00B63AD9
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63EC3	0_2_00B63EC3
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62A34	0_2_00B62A34
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6363E	0_2_00B6363E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6163D	0_2_00B6163D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63A13	0_2_00B63A13
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61618	0_2_00B61618
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63A0E	0_2_00B63A0E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62A0F	0_2_00B62A0F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6320D	0_2_00B6320D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61E6E	0_2_00B61E6E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63E59	0_2_00B63E59
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61A42	0_2_00B61A42
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63E4B	0_2_00B63E4B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63FB6	0_2_00B63FB6
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B657A5	0_2_00B657A5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61F95	0_2_00B61F95
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63F91	0_2_00B63F91
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61F84	0_2_00B61F84
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62F83	0_2_00B62F83
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61FF9	0_2_00B61FF9
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B633E8	0_2_00B633E8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61BD4	0_2_00B61BD4
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62FC0	0_2_00B62FC0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63B36	0_2_00B63B36
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63B3C	0_2_00B63B3C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6332D	0_2_00B6332D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63F11	0_2_00B63F11
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B61B75	0_2_00B61B75
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B62F64	0_2_00B62F64
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63F5F	0_2_00B63F5F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63346	0_2_00B63346
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B63B46	0_2_00B63B46
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B70259	0_2_00B70259
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B6FF28	0_2_00B6FF28
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B76018	0_2_00B76018
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B794A5	0_2_00B794A5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B79380	0_2_00B79380
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B795FD	0_2_00B795FD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B794FB	0_2_00B794FB
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B79719	0_2_00B79719
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B76551	0_2_00B76551
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9CC48	0_2_00B9CC48
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAA220	0_2_00BAA220
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BADE5D	0_2_00BADE5D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAB0B0	0_2_00BAB0B0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B4B3	0_2_00B9B4B3
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9BC8E	0_2_00B9BC8E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAACF8	0_2_00BAACF8
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAC8D5	0_2_00BAC8D5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B036	0_2_00B9B036
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B80A	0_2_00B9B80A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B40E	0_2_00B9B40E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B07E	0_2_00B9B07E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAD042	0_2_00BAD042
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAC1CD	0_2_00BAC1CD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B1C7	0_2_00B9B1C7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B8512B	0_2_00B8512B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B524	0_2_00B9B524
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BA0D05	0_2_00BA0D05
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BA9965	0_2_00BA9965
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAD149	0_2_00BAD149
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAA947	0_2_00BAA947
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BACE95	0_2_00BACE95
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B28E	0_2_00B9B28E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAAECF	0_2_00BAAECF
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9A239	0_2_00B9A239
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9A22A	0_2_00B9A22A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B96E11	0_2_00B96E11
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9CA5D	0_2_00B9CA5D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAEA48	0_2_00BAEA48
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9BBA7	0_2_00B9BBA7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BABB9F	0_2_00BABB9F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAAF95	0_2_00BAAF95
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B7F3	0_2_00B9B7F3
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9BBC0	0_2_00B9BBC0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAC734	0_2_00BAC734
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAD329	0_2_00BAD329
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B72D	0_2_00B9B72D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BAA71E	0_2_00BAA71E
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B84378	0_2_00B84378
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B9B75C	0_2_00B9B75C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD181A	0_2_00BD181A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD0864	0_2_00BD0864
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD6ACC	0_2_00BD6ACC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD337B	0_2_00BD337B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BC9880	0_2_00BC9880
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BCF826	0_2_00BCF826
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD0822	0_2_00BD0822
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BC101C	0_2_00BC101C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD0812	0_2_00BD0812
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BBA80B	0_2_00BBA80B
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD7133	0_2_00BD7133
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BDAAB0	0_2_00BDAAB0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD729C	0_2_00BD729C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BDA281	0_2_00BDA281
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB7A1C	0_2_00BB7A1C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB7A0D	0_2_00BB7A0D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB7A06	0_2_00BB7A06
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD3A64	0_2_00BD3A64
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BBABA9	0_2_00BBABA9
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD0397	0_2_00BD0397
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BDCBCD	0_2_00BDCBCD
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD13CF	0_2_00BD13CF
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BBDBC0	0_2_00BBDBC0
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD633A	0_2_00BD633A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD9B5C	0_2_00BD9B5C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BDC49F	0_2_00BDC49F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BBA49D	0_2_00BBA49D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD8C29	0_2_00BD8C29
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD9DEE	0_2_00BD9DEE
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB75EC	0_2_00BB75EC
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BC0DC5	0_2_00BC0DC5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BCED29	0_2_00BCED29
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB756C	0_2_00BB756C
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BC4EBF	0_2_00BC4EBF
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BCEE82	0_2_00BCEE82
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB7E33	0_2_00BB7E33
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB7E20	0_2_00BB7E20
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD1621	0_2_00BD1621
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD8E14	0_2_00BD8E14
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BDC64A	0_2_00BDC64A
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD77A4	0_2_00BD77A4
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BC9F84	0_2_00BC9F84
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB6F81	0_2_00BB6F81
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BD6F3C	0_2_00BD6F3C

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405329214.0000000002BBF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZentimo.exe0 vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405329214.0000000002649000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZentimo.exe0 vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000000.352403064.0000000000A22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZentimo.exe0 vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000000.352200957.000000000041A000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Binary or memory string: OriginalFilename vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Binary or memory string: OriginalFilenameZentimo.exe0 vs TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: ZentimoVideo.exe.0.dr	Binary string: \Device\Harddisk%d\Partition%dU
Source: ZentimoVideo.exe.0.dr	Binary string: \Device\HarddiskU

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@3/2@746/0

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

File created: C:\Users\user\Music\ZentimoDesignerUpdater

Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-NK89SF

Source: Yara match	File source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, type: SAMPLE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.352200957.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405329214.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

ReversingLabs: Detection: 48%

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: NATS-SEFI-ADD
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: NATS-DANO-ADD
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: jp-ocr-b-add
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: jp-ocr-hand-add
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: ISO_6937-2-add
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: <html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: n<html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: LAutomatically mount/dismount TrueCrypt volumes on device insertion/stopping;
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: LAutomatically mount/dismount TrueCrypt volumes on device insertion/stopping;
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: Registration is successful)Entered license information is not valid!HAttention! A 32-bit version of "%s" service is run under Windows 64-bit!6Attention! Too old version of "%s" service is running!xPlease download the program from our web-site and re-install it, otherwise some program functions will work incorrectly.iThe device stopping/returning process is not complete. Do you want to close the program now all the same?yIt is recommended to wait for some time until the program finishes all the operations and try to close the program again.%Do you want to close the program now?
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: before-stop-16
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: after-stop-16
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: before-stop-32
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: after-stop-32
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: device-stop-16
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: forced-stop
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	String found in binary or memory: device-stop

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

File read: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Process created: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Process created: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Static file information: File size 7649280 > 1048576

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x503800
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x213600

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Static PE information: More than 200 imports for user32.dll
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Static PE information: More than 200 imports for gdiplus.dll

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Static PE information: real checksum: 0x6c1f12 should be: 0x74d38f

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Static PE information: section name: .didata
Source: ZentimoVideo.exe.0.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0051AD1C push ds; retf	0_2_0051AD1D
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0051EDA3 push esi; ret	0_2_0051EDA4
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_0051EE94 pushfd ; retn 0053h	0_2_0052E5C5
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B87C17 push eax; retf	0_2_00B87C19
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B879FA push esp; retf	0_2_00B879FF
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B87A6E push eax; retf	0_2_00B87A6F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B87A5F push esp; retf	0_2_00B87A60
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B85FC5 pushfd ; retf	0_2_00B85FC7
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00B85F5F pushfd ; retf	0_2_00B85F61
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB91A9 pushad ; iretd	0_2_00BB91D3
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB923E pushad ; iretd	0_2_00BB923F
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB9496 push eax; iretd	0_2_00BB94B1
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Code function: 0_2_00BB9465 push esp; iretd	0_2_00BB9466

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

File created: C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe

Jump to dropped file

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ZentimoDesignerEditor			Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ZentimoDesignerEditor			Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Window / User API: threadDelayed 730	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Window / User API: threadDelayed 8838	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	Window / User API: foregroundWindowGot 1758	Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Dropped PE file which has not been started: C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe

Jump to dropped file

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3464	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3464	Thread sleep time: -41000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3468	Thread sleep count: 730 > 30	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3468	Thread sleep time: -2190000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3468	Thread sleep count: 8838 > 30	Jump to behavior
Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe TID: 3468	Thread sleep time: -26514000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Process created: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe "C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Memory written: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe base: 1C0000 value starts with: 4D5A

Jump to behavior

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	Binary or memory string: Shell_TrayWnd
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerSF\
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersic\ZentimoDesignerUpdater\ZentimoVideo.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, logs.dat.2.dr	Binary or memory string: [Program Manager]

Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405329214.0000000002649000.00000004.00001000.00020000.00000000.sdmp, TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000000.352200957.000000000041A000.00000020.00000001.01000000.00000003.sdmp, ZentimoVideo.exe.0.dr	Binary or memory string: Avp.exe
Source: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405329214.0000000002649000.00000004.00001000.00020000.00000000.sdmp, TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000000.352200957.000000000041A000.00000020.00000001.01000000.00000003.sdmp, ZentimoVideo.exe.0.dr	Binary or memory string: drweb32w.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3444, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-NK89SF

Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.adf40a.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe PID: 3444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe	49%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label
http://zentimo.com/enterkey.htmU	0%	Avira URL Cloud	safe
http://zentimo.com/blog/how-to-use-skins/U	0%	Avira URL Cloud	safe
http://zentimo.com/common/userdebugreport.phpU	0%	Avira URL Cloud	safe
http://zentimo.com/allVersions.htmP	0%	Avira URL Cloud	safe
http://zentimo.com/readaboutpro.htmU	0%	Avira URL Cloud	safe
http://zentimo.com/enterkey.htm?sm=regform	0%	Avira URL Cloud	safe
http://zentimo.com/order.htm	0%	Avira URL Cloud	safe
http://zentimo.com/restoreLicKey.htm?sm=regformU	0%	Avira URL Cloud	safe
http://zentimo.com/allVersions.htmU	0%	Avira URL Cloud	safe
http://www.safelyremove.com	0%	Avira URL Cloud	safe
http://zentimo.com/download.htm?sm=ServiceWrArch	0%	Avira URL Cloud	safe
http://zentimo.com/common/convert-license-key-svc?key=	0%	Avira URL Cloud	safe
http://zentimo.com/versioninfo/vernew.htm?	0%	Avira URL Cloud	safe
http://zentimo.com/download.htm?sm=ServiceWrVerU	0%	Avira URL Cloud	safe
alfredoperezpu1405.con-ip.com	0%	Avira URL Cloud	safe
http://zentimo.com	0%	Avira URL Cloud	safe
http://zentimo.com/blog/how-to-use-skins/	0%	Avira URL Cloud	safe
http://zentimo.com/download.htm?sm=CrackedVer_WrArch	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alfredoperezpu1405.con-ip.com	0.0.0.0	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
alfredoperezpu1405.con-ip.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://zentimo.com/allVersions.htmP	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/enterkey.htmU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/blog/how-to-use-skins/U	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp	false		high
http://zentimo.com/common/userdebugreport.phpU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/enterkey.htm?sm=regform	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/readaboutpro.htmU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/allVersions.htmU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.safelyremove.com	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/order.htm	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/restoreLicKey.htm?sm=regformU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false		high
http://zentimo.com/common/convert-license-key-svc?key=	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/download.htm?sm=ServiceWrArch	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/versioninfo/vernew.htm?	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/download.htm?sm=ServiceWrVerU	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com	ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/blog/how-to-use-skins/	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://zentimo.com/download.htm?sm=CrackedVer_WrArch	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe, ZentimoVideo.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559772
Start date and time:	2024-11-20 22:40:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe (renamed file extension from bin to exe)
Original Sample Name:	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.bin
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@3/2@746/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 212 Number of non-executed functions: 44
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Simulations

Behavior and APIs

Time	Type	Description
13:42:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ZentimoDesignerEditor C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe
13:42:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ZentimoDesignerEditor C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe
16:41:51	API Interceptor	8529332x Sleep call for process: TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe modified

Process:	C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
File Type:	data
Category:	dropped
Size (bytes):	462
Entropy (8bit):	3.4635588344265
Encrypted:	false
SSDEEP:	12:6lzpNFec0WFe5BWFe5BWdBhTcemOSJOW+:6RpNgc0WqBWqBWVmFOW+
MD5:	94F4F272EB7504B8D1EE460176403F4D
SHA1:	0F479A42C2597BBB29CD164CC94888BAAC512D1D
SHA-256:	FA348902E0FFCB0189C8B71B45A60160CF5601943559A7242C96FC222925A0F0
SHA-512:	08E2BE9845B4AA98C49DA313E88D5A8B86B716C5A3EF7165E9633DD9F9C3E1A35C8F4E5F2AD3FAD8F4F008E69D4FCDFE51BE00065409CE67EB02A3A3B4BC7589
Malicious:	true
Reputation:	low
Preview:	....[.2.0.2.4./.1.1./.2.0. .1.6.:.4.1.:.5.1. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.U.s.e.r.s.\.A.l.b.u.s.\.M.u.s.i.c.\.Z.e.n.t.i.m.o.D.e.s.i.g.n.e.r.U.p.d.a.t.e.r.\.Z.e.n.t.i.m.o.V.i.d.e.o...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe

Download File

Process:	C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	977447173
Entropy (8bit):	0.10198765652193818
Encrypted:	false
SSDEEP:
MD5:	2C146E01490493821270E5620152AB32
SHA1:	8AC2185B962AEF3FDF7952C6692EAAFA74D75486
SHA-256:	65C01AA66B7C709159F7E7482CF6118996DED94115D738E55409AD3E8FCC0ABC
SHA-512:	F026632B14B3A92A5841B3499D4BD7E9B20E803A655344D544FEC3B7ADA74DEDBFB8A201232D8E3C44C57C66EC3D3E78C062B5F620BB4D86406C63C41C489C1C
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L... .qe.................hP..L$......~P.......P...@...........................}.......l..........@...........................@U.......\..5!..........$k..\...PV.hP...........................@V.....................HWU.......U.`]...................text....@P......8P................. ..`.itext...0...PP..0...<P............. ..`.data....0....P..*...lP.............@....bss..........R.......R..................idata.......@U.......R.............@....didata..`....U..^..."S.............@....tls.........0V.......S..................rdata...p...@V.......S.............@..@.rsrc....5!...\..6!...S.............@..@......................................................n......$k.............@..@........................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.607510368640178
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
File size:	7'649'280 bytes
MD5:	fb652b5ff3a97ebbb8c9bf69c7010c1c
SHA1:	49acdeb895d801dd4439fad35337b19baca56d65
SHA256:	4d37f7aea76ccb788710e7d3a8d2553964142a835115a9f0768f33b286400352
SHA512:	371530bd53d32ef3d3f98c833186c17ee62901826b37a3dab762217ca4a41b2cb9b70e90c5b0cb6d190eada569554001b73e406f442ee29c2549b7f140c4032a
SSDEEP:	196608:OFltGUFFD+Uo2jWZBvJ8cQhjZUsd8QZFupe:AtFFD+UNjWZBIhDZ5
TLSH:	ED767C12F644603FD1771A364C678594A83A7EB03A35DC4B3AE42F0D5F39A82BD2A717
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	27311b0f65e16b68

Static PE Info

General

Entrypoint:	0x907edc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x6571B820 [Thu Dec 7 12:18:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3669a22fd198f5e77b9add75a89e985d

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 008F571Ch
call 00007F7D216F8A74h
mov eax, dword ptr [0092A254h]
mov eax, dword ptr [eax]
call 00007F7D21370939h
mov ecx, dword ptr [00929588h]
mov eax, dword ptr [0092A254h]
mov eax, dword ptr [eax]
mov edx, dword ptr [008CADF0h]
call 00007F7D21370939h
mov eax, dword ptr [0092A254h]
mov eax, dword ptr [eax]
call 00007F7D21370A91h
call 00007F7D211F8008h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x554000	0x8b80	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5cb000	0x21359c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6b2400	0x5c08	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x565000	0x65068	.rdata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x564000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x555748	0x13c4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x55d000	0x5d60	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x504000	0x503800	811d935b1173bead5d4b6bb3387d79dd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x505000	0x3000	0x3000	092f9a31dae6fb0ee3988ce47849071d	False	0.512451171875	data	6.11913762815835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x508000	0x23000	0x22a00	23d18245d4202f9fdcf46e941348116a	False	0.372461642599278	data	5.695027946131176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x52b000	0x29000	0x29000	618c04abec6c442aab8b86a1ee3b0e53	False	0.20950838414634146	data	5.040625384243825	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x554000	0x9000	0x8c00	0ebb73fe995f49bb1f5b35014cb7e5c9	False	0.27193080357142857	data	5.276841973546904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x55d000	0x6000	0x5e00	4bc7515bbf4ee1070a154812be165e83	False	0.23458277925531915	data	5.010908263028241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x563000	0x1000	0x1000	57972e07dea3fcd8e3f9227b56a33ad9	False	0.396240234375	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "\226"	4.177558791494038	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x564000	0x67000	0x200	25b08d155125a709269cd6cad2c92449	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "\226"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5cb000	0x21359c	0x213600	02e0d57c045e7524516ef2b5130e4fa6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x5d1d5c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x5d1e90	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x5d1fc4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x5d20f8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x5d222c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x5d2360	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x5d2494	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x5d25c8	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19385026737967914
RT_CURSOR	0x5d28b4	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18716577540106952
RT_CURSOR	0x5d2ba0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.2179144385026738
RT_CURSOR	0x5d2e8c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.21122994652406418
RT_CURSOR	0x5d3178	0x134	AmigaOS bitmap font "(", fc_YSize 4294967064, 3584 elements, 2nd "\377\270w\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	German	Germany	0.32792207792207795
RT_CURSOR	0x5d32ac	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	German	Germany	0.5292207792207793
RT_CURSOR	0x5d33e0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.3538961038961039
RT_CURSOR	0x5d3514	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x5d3800	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19117647058823528
RT_CURSOR	0x5d3aec	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19786096256684493
RT_CURSOR	0x5d3dd8	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x5d40c4	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_CURSOR	0x5d43b0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_BITMAP	0x5d469c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x5d486c	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x5d4a50	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x5d4c20	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x5d4df0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x5d4fc0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x5d5190	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x5d5360	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x5d5530	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x5d5700	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x5d58d0	0x928	Device independent bitmap graphic, 24 x 24 x 32, image size 0	Russian	Russia	0.04906143344709898
RT_BITMAP	0x5d61f8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0x5d62e0	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.1089588377723971
RT_BITMAP	0x5d6fc8	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.10714285714285714
RT_BITMAP	0x5d7cb0	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.0950363196125908
RT_BITMAP	0x5d8998	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.21266233766233766
RT_BITMAP	0x5d8c00	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.17207792207792208
RT_BITMAP	0x5d8e68	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.1672077922077922
RT_BITMAP	0x5d90d0	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11955205811138014
RT_BITMAP	0x5d9db8	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11561743341404358
RT_BITMAP	0x5daaa0	0xd28	Device independent bitmap graphic, 144 x 16 x 8, image size 2304			0.23634204275534443
RT_BITMAP	0x5db7c8	0x4b2a	Device independent bitmap graphic, 400 x 16 x 24, image size 0, resolution 2834 x 2834 px/m			0.2749194470429269
RT_BITMAP	0x5e02f4	0x126	Device independent bitmap graphic, 9 x 9 x 24, image size 0, resolution 2834 x 2834 px/m			0.5850340136054422
RT_BITMAP	0x5e041c	0x126	Device independent bitmap graphic, 9 x 9 x 24, image size 0, resolution 2834 x 2834 px/m			0.5918367346938775
RT_ICON	0x5e0544	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5023987206823027
RT_ICON	0x5e13ec	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6033393501805054
RT_ICON	0x5e1c94	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3338150289017341
RT_ICON	0x5e21fc	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.1801047430245288
RT_ICON	0x624224	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3094398340248963
RT_ICON	0x6267cc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.38461538461538464
RT_ICON	0x627874	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4175531914893617
RT_ICON	0x627cdc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5035460992907801
RT_ICON	0x628144	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5088652482269503
RT_ICON	0x6285ac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5053191489361702
RT_ICON	0x628a14	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5044326241134752
RT_ICON	0x628e7c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.49379432624113473
RT_ICON	0x6292e4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4778368794326241
RT_ICON	0x62974c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.46631205673758863
RT_ICON	0x629bb4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4671985815602837
RT_ICON	0x62a01c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.48404255319148937
RT_ICON	0x62a484	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4920212765957447
RT_ICON	0x62a8ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.49113475177304966
RT_ICON	0x62ad54	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4875886524822695
RT_ICON	0x62b1bc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.45478723404255317
RT_ICON	0x62b624	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.48315602836879434
RT_ICON	0x62ba8c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.48138297872340424
RT_ICON	0x62bef4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.46631205673758863
RT_ICON	0x62c35c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.49024822695035464
RT_ICON	0x62c7c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.48936170212765956
RT_ICON	0x62cc2c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4946808510638298
RT_ICON	0x62d094	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4734042553191489
RT_ICON	0x62d4fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4787234042553192
RT_ICON	0x62d964	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.48226950354609927
RT_ICON	0x62ddcc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5948581560283688
RT_ICON	0x62e234	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5921985815602837
RT_ICON	0x62e69c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.575354609929078
RT_ICON	0x62eb04	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.651595744680851
RT_ICON	0x62ef6c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.18528368794326242
RT_ICON	0x62f3d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5824468085106383
RT_ICON	0x62f83c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5177304964539007
RT_ICON	0x62fca4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6560283687943262
RT_ICON	0x63010c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5363475177304965
RT_ICON	0x630574	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5948581560283688
RT_ICON	0x6309dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6551418439716312
RT_ICON	0x630e44	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6196808510638298
RT_ICON	0x6312ac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.62677304964539
RT_ICON	0x631714	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6400709219858156
RT_ICON	0x631b7c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6648936170212766
RT_ICON	0x631fe4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5797872340425532
RT_ICON	0x63244c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5425531914893617
RT_ICON	0x6328b4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6054964539007093
RT_ICON	0x632d1c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6063829787234043
RT_ICON	0x633184	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6320921985815603
RT_ICON	0x6335ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6223404255319149
RT_ICON	0x633a54	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5806737588652482
RT_ICON	0x633ebc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6179078014184397
RT_ICON	0x634324	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5292553191489362
RT_ICON	0x63478c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5292553191489362
RT_ICON	0x634bf4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6143617021276596
RT_ICON	0x63505c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6285460992907801
RT_ICON	0x6354c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6666666666666666
RT_ICON	0x63592c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.62677304964539
RT_ICON	0x635d94	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6578014184397163
RT_ICON	0x6361fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.30851063829787234
RT_ICON	0x636664	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.499113475177305
RT_ICON	0x636acc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.651595744680851
RT_ICON	0x636f34	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.601063829787234
RT_ICON	0x63739c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5859929078014184
RT_ICON	0x637804	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5859929078014184
RT_ICON	0x637c6c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6436170212765957
RT_ICON	0x6380d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6436170212765957
RT_ICON	0x63853c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6436170212765957
RT_ICON	0x6389a4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.598404255319149
RT_ICON	0x638e0c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6028368794326241
RT_ICON	0x639274	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.34574468085106386
RT_ICON	0x6396dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.625
RT_ICON	0x639b44	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6214539007092199
RT_ICON	0x639fac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6081560283687943
RT_ICON	0x63a414	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6099290780141844
RT_ICON	0x63a87c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.625886524822695
RT_ICON	0x63ace4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.5957446808510638
RT_ICON	0x63b14c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6117021276595744
RT_ICON	0x63b5b4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.41932624113475175
RT_ICON	0x63ba1c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4370567375886525
RT_ICON	0x63be84	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.44060283687943264
RT_ICON	0x63c2ec	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4920212765957447
RT_ICON	0x63c754	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.47429078014184395
RT_ICON	0x63cbbc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.46187943262411346
RT_ICON	0x63d024	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.4875886524822695
RT_DIALOG	0x63d48c	0x52	data			0.7682926829268293
RT_DIALOG	0x63d4e0	0x52	data			0.7560975609756098
RT_STRING	0x63d534	0xa0	data			0.5875
RT_STRING	0x63d5d4	0x544	data			0.3701780415430267
RT_STRING	0x63db18	0x708	data			0.34
RT_STRING	0x63e220	0x3cc	data			0.3837448559670782
RT_STRING	0x63e5ec	0x5bc	data			0.35967302452316074
RT_STRING	0x63eba8	0x5b8	data			0.3770491803278688
RT_STRING	0x63f160	0x748	data			0.32457081545064376
RT_STRING	0x63f8a8	0x730	data			0.33695652173913043
RT_STRING	0x63ffd8	0x858	data			0.3052434456928839
RT_STRING	0x640830	0x7d0	data			0.332
RT_STRING	0x641000	0x4e8	data			0.3184713375796178
RT_STRING	0x6414e8	0xbe0	data			0.2598684210526316
RT_STRING	0x6420c8	0x4f0	data			0.3615506329113924
RT_STRING	0x6425b8	0x870	data			0.32314814814814813
RT_STRING	0x642e28	0x2d0	data			0.37222222222222223
RT_STRING	0x6430f8	0x4bc	data			0.39603960396039606
RT_STRING	0x6435b4	0x70c	data			0.34534368070953436
RT_STRING	0x643cc0	0xaf4	data			0.23716119828815976
RT_STRING	0x6447b4	0x7dc	data			0.36083499005964215
RT_STRING	0x644f90	0x458	data			0.4136690647482014
RT_STRING	0x6453e8	0x884	data			0.11192660550458716
RT_STRING	0x645c6c	0x860	data			0.13712686567164178
RT_STRING	0x6464cc	0x84c	data			0.1548964218455744
RT_STRING	0x646d18	0x7e8	data			0.1590909090909091
RT_STRING	0x647500	0x9a8	data			0.12135922330097088
RT_STRING	0x647ea8	0x984	data			0.12397372742200329
RT_STRING	0x64882c	0x2c8	data			0.3862359550561798
RT_STRING	0x648af4	0x104	data			0.6730769230769231
RT_STRING	0x648bf8	0x148	data			0.600609756097561
RT_STRING	0x648d40	0x1d8	data			0.3834745762711864
RT_STRING	0x648f18	0x244	data			0.4810344827586207
RT_STRING	0x64915c	0x20c	data			0.41030534351145037
RT_STRING	0x649368	0x214	AmigaOS bitmap font "e", fc_YSize 24832, 29184 elements, 2nd "a", 3rd "o"			0.4774436090225564
RT_STRING	0x64957c	0x17c	data			0.5552631578947368
RT_STRING	0x6496f8	0x394	data			0.4126637554585153
RT_STRING	0x649a8c	0x2e8	data			0.45698924731182794
RT_STRING	0x649d74	0x5a4	data			0.3490304709141274
RT_STRING	0x64a318	0x2b8	data			0.44971264367816094
RT_STRING	0x64a5d0	0x404	data			0.3842412451361868
RT_STRING	0x64a9d4	0xf4c	data			0.21884576098059244
RT_STRING	0x64b920	0xb10	data			0.2891949152542373
RT_STRING	0x64c430	0xa2c	data			0.3248847926267281
RT_STRING	0x64ce5c	0x920	data			0.2833904109589041
RT_STRING	0x64d77c	0x710	data			0.3008849557522124
RT_STRING	0x64de8c	0x3e4	data			0.428714859437751
RT_STRING	0x64e270	0x444	data			0.4010989010989011
RT_STRING	0x64e6b4	0x348	data			0.4166666666666667
RT_STRING	0x64e9fc	0x478	data			0.3977272727272727
RT_STRING	0x64ee74	0x38c	data			0.44162995594713655
RT_STRING	0x64f200	0x398	data			0.3423913043478261
RT_STRING	0x64f598	0x2ac	data			0.46345029239766083
RT_STRING	0x64f844	0x288	data			0.49691358024691357
RT_STRING	0x64facc	0x418	data			0.34446564885496184
RT_STRING	0x64fee4	0x3f0	data			0.34523809523809523
RT_STRING	0x6502d4	0x298	data			0.4954819277108434
RT_STRING	0x65056c	0x374	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.43665158371040724
RT_STRING	0x6508e0	0x33c	data			0.4577294685990338
RT_STRING	0x650c1c	0xa0	data			0.7
RT_STRING	0x650cbc	0xe0	data			0.6473214285714286
RT_STRING	0x650d9c	0x300	data			0.4153645833333333
RT_STRING	0x65109c	0x268	data			0.487012987012987
RT_STRING	0x651304	0x3cc	data			0.37448559670781895
RT_STRING	0x6516d0	0x3e0	data			0.38911290322580644
RT_STRING	0x651ab0	0x4d0	data			0.3060064935064935
RT_STRING	0x651f80	0x3a0	data			0.42564655172413796
RT_STRING	0x652320	0x37c	data			0.35650224215246634
RT_STRING	0x65269c	0x604	data			0.32142857142857145
RT_STRING	0x652ca0	0x490	data			0.3476027397260274
RT_STRING	0x653130	0x390	data			0.34978070175438597
RT_STRING	0x6534c0	0x3e4	data			0.3855421686746988
RT_STRING	0x6538a4	0x21c	data			0.40555555555555556
RT_STRING	0x653ac0	0xbc	data			0.6542553191489362
RT_STRING	0x653b7c	0xfc	data			0.6349206349206349
RT_STRING	0x653c78	0x370	data			0.41704545454545455
RT_STRING	0x653fe8	0x474	data			0.29385964912280704
RT_STRING	0x65445c	0x36c	data			0.4018264840182648
RT_STRING	0x6547c8	0x2c4	data			0.4392655367231638
RT_RCDATA	0x654a8c	0x10	data			1.5
RT_RCDATA	0x654a9c	0x1c88	data			0.4976725082146769
RT_RCDATA	0x656724	0x2	data	English	United States	5.0
RT_RCDATA	0x656728	0x2686	Delphi compiled form 'TAboutBox'			0.2743865341715676
RT_RCDATA	0x658db0	0x1a1f	Delphi compiled form 'TAddFileToRunListForm'			0.3527740391804995
RT_RCDATA	0x65a7d0	0xb55	Delphi compiled form 'TAddPortableAppForm'			0.43536711478800416
RT_RCDATA	0x65b328	0xda1	Delphi compiled form 'TChangeDriveLetterForm'			0.8460877042132416
RT_RCDATA	0x65c0cc	0x62a	Delphi compiled form 'TChangeTrueCryptPathForm'			0.48859315589353614
RT_RCDATA	0x65c6f8	0x4be	Delphi compiled form 'TContinueSpeedTestForm'			0.5527182866556837
RT_RCDATA	0x65cbb8	0xa4	Delphi compiled form 'TCRForm'			0.926829268292683
RT_RCDATA	0x65cc5c	0x842	Delphi compiled form 'TDevicePowerOffSuggestionForm'			0.4749290444654683
RT_RCDATA	0x65d4a0	0x39a	Delphi compiled form 'TDeviceTechInfoForm'			0.5748373101952278
RT_RCDATA	0x65d83c	0x3996	Delphi compiled form 'TdmCRImages'			0.931284764618098
RT_RCDATA	0x6611d4	0x1714d	Delphi compiled form 'TdmZenImages'			0.5620524428554807
RT_RCDATA	0x678324	0x706	Delphi compiled form 'TfraServicesToStop'			0.5011123470522804
RT_RCDATA	0x678a2c	0x5b6	Delphi compiled form 'TfrmCheckNewVersion'			0.5027359781121751
RT_RCDATA	0x678fe4	0x549	Delphi compiled form 'TfrmChooseUSBImage'			0.5151515151515151
RT_RCDATA	0x679530	0x6e9	Delphi compiled form 'TfrmCRMessageBox'			0.4895421141888072
RT_RCDATA	0x679c1c	0x103e	Delphi compiled form 'TfrmDebugCentreForm'			0.2886002886002886
RT_RCDATA	0x67ac5c	0x27fd	Delphi compiled form 'TfrmDebugMessage'			0.7504151606916089
RT_RCDATA	0x67d45c	0x907	Delphi compiled form 'TfrmDisablingDeviceWarning'			0.4893985287754219
RT_RCDATA	0x67dd64	0x120b	Delphi compiled form 'TfrmEditDriveProperties'			0.3210651656202641
RT_RCDATA	0x67ef70	0xb8f	Delphi compiled form 'TfrmEnableDLMMsg'			0.3970936127069956
RT_RCDATA	0x67fb00	0x834	Delphi compiled form 'TfrmEndSessionNotify'			0.4847619047619048
RT_RCDATA	0x680334	0x7ad	Delphi compiled form 'TfrmKeyConversionError'			0.4580152671755725
RT_RCDATA	0x680ae4	0x5bf	Delphi compiled form 'TfrmLetterViolation'			0.5241332426920462
RT_RCDATA	0x6810a4	0x726	Delphi compiled form 'TfrmNeighboursRestartIsRequired'			0.5453551912568306
RT_RCDATA	0x6817cc	0x2498	Delphi compiled form 'TfrmSafelyRemoveMenu'			0.24775832621690863
RT_RCDATA	0x683c64	0x6b9	Delphi compiled form 'TfrmSelectServicesToStop'			0.5241138872748402
RT_RCDATA	0x684320	0x9a1	Delphi compiled form 'TfrmStopCardReaderMsg'			0.47505070993914805
RT_RCDATA	0x684cc4	0x1cc2	Delphi compiled form 'TfrmStoppingUSBDevice'			0.32314588427057866
RT_RCDATA	0x686988	0x219	Delphi compiled form 'TfrmTestServiceStopping'			0.6294227188081937
RT_RCDATA	0x686ba4	0x1520	Delphi compiled form 'TfrmTroubleShootThings'			0.5652736686390533
RT_RCDATA	0x6880c4	0x1933	Delphi compiled form 'TfrmUnableToReturnDeviceBack'			0.3642846070376686
RT_RCDATA	0x6899f8	0x1656	Delphi compiled form 'TfrmUnableToStopDevice'			0.3744316194473592
RT_RCDATA	0x68b050	0x4f0b	Delphi compiled form 'TMainForm'			0.5699036323202372
RT_RCDATA	0x68ff5c	0x1647	Delphi compiled form 'TNag'			0.3242153252674031
RT_RCDATA	0x6915a4	0xc246	Delphi compiled form 'TOptions'			0.33996863312824227
RT_RCDATA	0x69d7ec	0xcf7c	Delphi compiled form 'TProperties'			0.44549664884403944
RT_RCDATA	0x6aa768	0x65e	Delphi compiled form 'TProxySettingsForm'			0.4134969325153374
RT_RCDATA	0x6aadc8	0xc306	Delphi compiled form 'TQuickSettingsWizardForm'			0.8810840043264031
RT_RCDATA	0x6b70d0	0x809	Delphi compiled form 'TRegistration'			0.46037919299951385
RT_RCDATA	0x6b78dc	0x595	Delphi compiled form 'TRestartSystemNoticeForm'			0.5325402379286214
RT_RCDATA	0x6b7e74	0x431	Delphi compiled form 'TSaveSettingsErrorForm'			0.570363466915191
RT_RCDATA	0x6b82a8	0x61d	Delphi compiled form 'TSelectDisk'			0.49201277955271566
RT_RCDATA	0x6b88c8	0xb01	Delphi compiled form 'TSpeedTestProcessForm'			0.4053958111466099
RT_RCDATA	0x6b93cc	0x884	Delphi compiled form 'TSpeedTestResultsForm'			0.5100917431192661
RT_RCDATA	0x6b9c50	0x2bac	Delphi compiled form 'TSpeedTestSuggestionForm'			0.8614490161001789
RT_RCDATA	0x6bc7fc	0xd42	Delphi compiled form 'TStopAllVisibleDevicesMsg'			0.8529758397171479
RT_RCDATA	0x6bd540	0x589c	Delphi compiled form 'TTemplatesForm'			0.34932110738846767
RT_RCDATA	0x6c2ddc	0x43b	Delphi compiled form 'TZenAppController'			0.4515235457063712
RT_RCDATA	0x6c3218	0x102b	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0026576467745831
RT_RCDATA	0x6c4244	0x101e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.002666020358701
RT_RCDATA	0x6c5264	0xc7	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.015075376884422
RT_RCDATA	0x6c532c	0x98	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.006578947368421
RT_RCDATA	0x6c53c4	0xcd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0146341463414634
RT_RCDATA	0x6c5494	0xcd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0146341463414634
RT_RCDATA	0x6c5564	0x187	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0281329923273657
RT_RCDATA	0x6c56ec	0x1b0	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.025462962962963
RT_RCDATA	0x6c589c	0x314	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.013959390862944
RT_RCDATA	0x6c5bb0	0x34a	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.013064133016627
RT_RCDATA	0x6c5efc	0x229	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0198915009041591
RT_RCDATA	0x6c6128	0x113	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.010909090909091
RT_RCDATA	0x6c623c	0x321	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.013732833957553
RT_RCDATA	0x6c6560	0x181	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0285714285714285
RT_RCDATA	0x6c66e4	0x2f0	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.014627659574468
RT_RCDATA	0x6c69d4	0x186	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.9794871794871794
RT_RCDATA	0x6c6b5c	0x137	PNG image data, 14 x 9, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0257234726688103
RT_RCDATA	0x6c6c94	0xf31	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.002828490614554
RT_RCDATA	0x6c7bc8	0xf23	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0028387096774194
RT_RCDATA	0x6c8aec	0x161	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0226628895184136
RT_RCDATA	0x6c8c50	0x246	PNG image data, 13 x 11, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0189003436426116
RT_RCDATA	0x6c8e98	0x3aee	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	Russian	Russia	0.06456317115206152
RT_RCDATA	0x6cc988	0x22b	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0198198198198198
RT_RCDATA	0x6ccbb4	0xaffb	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0004661383765066
RT_RCDATA	0x6d7bb0	0x9f7	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.004312034496276
RT_RCDATA	0x6d85a8	0x9f7	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.004312034496276
RT_RCDATA	0x6d8fa0	0x4a8	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0092281879194631
RT_RCDATA	0x6d9448	0xcb	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0147783251231528
RT_RCDATA	0x6d9514	0xcc	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0147058823529411
RT_RCDATA	0x6d95e0	0x2fd	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0143790849673202
RT_RCDATA	0x6d98e0	0x363	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0126874279123415
RT_RCDATA	0x6d9c44	0xf84	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0027693856998994
RT_RCDATA	0x6dabc8	0xf7c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0027749747729566
RT_RCDATA	0x6dbb44	0x1c8	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0241228070175439
RT_RCDATA	0x6dbd0c	0x1c0	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0245535714285714
RT_RCDATA	0x6dbecc	0xf41	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0028169014084507
RT_RCDATA	0x6dce10	0xf39	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0028226841159866
RT_RCDATA	0x6ddd4c	0x181	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0285714285714285
RT_RCDATA	0x6dded0	0x17e	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0287958115183247
RT_RCDATA	0x6de050	0x18e	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0276381909547738
RT_RCDATA	0x6de1e0	0x18d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0277078085642317
RT_RCDATA	0x6de370	0x222	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.02014652014652
RT_RCDATA	0x6de594	0x232	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.019572953736655
RT_RCDATA	0x6de7c8	0xd6	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.985981308411215
RT_GROUP_CURSOR	0x6de8a0	0x14	data			1.4
RT_GROUP_CURSOR	0x6de8b4	0x14	data			1.4
RT_GROUP_CURSOR	0x6de8c8	0x14	data			1.4
RT_GROUP_CURSOR	0x6de8dc	0x14	data			1.4
RT_GROUP_CURSOR	0x6de8f0	0x14	data			1.4
RT_GROUP_CURSOR	0x6de904	0x14	data			1.4
RT_GROUP_CURSOR	0x6de918	0x14	data			1.4
RT_GROUP_CURSOR	0x6de92c	0x14	data			1.4
RT_GROUP_CURSOR	0x6de940	0x14	data			1.4
RT_GROUP_CURSOR	0x6de954	0x14	data			1.4
RT_GROUP_CURSOR	0x6de968	0x14	data			1.4
RT_GROUP_CURSOR	0x6de97c	0x14	data			1.4
RT_GROUP_CURSOR	0x6de990	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x6de9a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x6de9b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x6de9cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6de9e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6de9f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6dea08	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x6dea1c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x6dea30	0x68	data	English	United States	0.6826923076923077
RT_GROUP_ICON	0x6dea98	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deaac	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deac0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dead4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deae8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deafc	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb10	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb24	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb38	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb4c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb60	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb74	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb88	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deb9c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6debb0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6debc4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6debd8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6debec	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec00	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec14	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec28	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec3c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec50	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec64	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec78	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dec8c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deca0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6decb4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6decc8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6decdc	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6decf0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded04	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded18	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded2c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded40	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded54	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded68	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded7c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6ded90	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deda4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dedb8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dedcc	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dede0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dedf4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee08	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee1c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee30	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee44	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee58	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee6c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee80	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6dee94	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deea8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deebc	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deed0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deee4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deef8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def0c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def20	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def34	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def48	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def5c	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def70	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def84	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6def98	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6defac	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6defc0	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6defd4	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6defe8	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6deffc	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df010	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df024	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df038	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df04c	0x14	data	Russian	Russia	1.15
RT_GROUP_ICON	0x6df060	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df074	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df088	0x14	data	Russian	Russia	1.25
RT_GROUP_ICON	0x6df09c	0x14	data	Russian	Russia	1.25
RT_VERSION	0x6df0b0	0x324	data	English	United States	0.44527363184079605
RT_DLGINCLUDE	0x6df3d4	0x78c36	PC bitmap, Windows 3.x format, 61896 x 2 x 43, image size 494976, cbSize 494646, bits offset 54			0.7606025319117106
RT_ANIICON	0x75800c	0xea97	PC bitmap, Windows 3.x format, 8333 x 2 x 50, image size 60908, cbSize 60055, bits offset 54			0.3737407376571476
RT_ANIICON	0x766aa4	0xa55f	PC bitmap, Windows 3.x format, 5560 x 2 x 41, image size 42722, cbSize 42335, bits offset 54			0.34463210109838194
RT_ANIICON	0x771004	0x9eed	PC bitmap, Windows 3.x format, 5560 x 2 x 39, image size 41522, cbSize 40685, bits offset 54			0.4177215189873418
RT_ANIICON	0x77aef4	0x34759	PC bitmap, Windows 3.x format, 27771 x 2 x 40, image size 214884, cbSize 214873, bits offset 54			0.47706784938079705
RT_ANIICON	0x7af650	0x2e192	PC bitmap, Windows 3.x format, 23742 x 2 x 41, image size 189555, cbSize 188818, bits offset 54			0.4872840513086676
RT_MANIFEST	0x7dd7e4	0x6db	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4096866096866097
RT_MANIFEST	0x7ddec0	0x6db	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia	0.4096866096866097

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	MessageBoxA, CharNextW, LoadStringW
user32.dll	SetClassLongW, GetClassLongW, SetWindowLongW, GetWindowLongW, CreateWindowExW, WindowFromPoint, WaitMessage, ValidateRect, UpdateWindow, UnregisterHotKey, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAscii, SystemParametersInfoW, SubtractRect, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenuItemBitmaps, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCaretPos, SetCapture, SetActiveWindow, SendMessageTimeoutW, SendMessageA, SendMessageW, ScrollWindowEx, ScrollWindow, ScrollDC, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterHotKey, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PtInRect, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, OffsetRect, OemToCharA, NotifyWinEvent, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LockWindowUpdate, LoadStringW, LoadKeyboardLayoutW, LoadImageW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsIconic, IsDialogMessageA, IsDialogMessageW, IsClipboardFormatAvailable, IsChild, IsCharAlphaNumericW, IsCharAlphaW, InvalidateRect, InsertMenuItemW, InsertMenuW, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardFormatNameW, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCaretPos, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumDesktopWindows, EnumClipboardFormats, EnumChildWindows, EndPaint, EndMenu, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DestroyCaret, DeleteMenu, DeferWindowPos, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIconIndirect, CreateIconFromResourceEx, CreateIcon, CreateCaret, CreateAcceleratorTableW, CountClipboardFormats, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, ChildWindowFromPoint, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, BeginDeferWindowPos, CharLowerBuffA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	lstrlenA, lstrlenW, lstrcmpW, WriteProcessMemory, WritePrivateProfileStringW, WriteFile, WideCharToMultiByte, WaitNamedPipeW, WaitForSingleObject, WaitForMultipleObjectsEx, WaitForMultipleObjects, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFreeEx, VirtualFree, VirtualAllocEx, VirtualAlloc, VerLanguageNameW, UnmapViewOfFile, TryEnterCriticalSection, TerminateThread, TerminateProcess, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, SetCurrentDirectoryW, SearchPathW, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, QueryDosDeviceW, IsDebuggerPresent, OpenProcess, MulDiv, MoveFileW, MapViewOfFile, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExW, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalSize, GlobalMemoryStatus, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVolumeInformationW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetTimeZoneInformation, GetTickCount, GetThreadPriority, GetThreadLocale, GetThreadContext, GetTempPathW, GetTempFileNameW, GetSystemTime, GetSystemInfo, GetSystemDirectoryW, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringW, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableW, GetEnvironmentStringsW, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryW, GetComputerNameW, GetCPInfoExW, GetCPInfo, GetBinaryTypeW, GetACP, FreeResource, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FreeEnvironmentStringsW, FormatMessageW, FlushInstructionCache, FlushFileBuffers, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExpandEnvironmentStringsW, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DosDateTimeToFileTime, DeviceIoControl, DeleteFileW, DeleteCriticalSection, CreateThread, CreateRemoteThread, CreateMutexW, CreateFileMappingW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringA, CompareStringW, CloseHandle, CallNamedPipeW
advapi32.dll	SetSecurityDescriptorDacl, RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, LookupPrivilegeNameW, LookupPrivilegeDisplayNameW, InitiateSystemShutdownW, InitializeSecurityDescriptor, GetUserNameW, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, ReleaseStgMedium, OleFlushClipboard, OleGetClipboard, OleSetClipboard, DoDragDrop, RevokeDragDrop, RegisterDragDrop, OleUninitialize, OleInitialize, CreateDataAdviseHolder, CoTaskMemFree, CoTaskMemAlloc, CoCreateGuid, StringFromCLSID, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawIndirect, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
shell32.dll	SHGetFileInfoW, ShellExecuteExW, ShellExecuteW, Shell_NotifyIconW, SHAppBarMessage, FindExecutableW
shell32.dll	SHChangeNotifyRegister, SHChangeNotifyDeregister, SHChangeNotification_Unlock, SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHGetMalloc, SHGetDesktopFolder, SHBrowseForFolderW
kernel32.dll	MulDiv
oleacc.dll	LresultFromObject
winmm.dll	timeGetTime, PlaySoundW
GDI32.DLL	GetRandomRgn
kernel32.dll	GetVersionExW
kernel32.dll	GetProcAddress, LoadLibraryA, GetModuleHandleA
kernel32.dll	GetVolumePathNamesForVolumeNameW, QueryDosDeviceW, Sleep, GetLastError, ExitProcess, OpenProcess
kernel32.dll	FindVolumeClose, GetVolumePathNameW, FindNextVolumeW, FindFirstVolumeW, GetVolumeNameForVolumeMountPointW
cfgmgr32.dll	CM_Get_Device_IDW, CM_Get_Device_ID_Size
CfgMgr32.dll	CM_Get_DevNode_Status
SetupApi.dll	CM_Get_Parent, CM_Locate_DevNodeW, SetupDiSetDeviceRegistryPropertyW, SetupDiGetDeviceRegistryPropertyW, CM_Reenumerate_DevNode, CM_Setup_DevNode, CM_Query_And_Remove_SubTreeW, CM_Request_Device_EjectW, SetupDiCallClassInstaller, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInstallParamsW, SetupDiSetClassInstallParamsW, SetupDiGetDeviceInstanceIdW, SetupDiGetDeviceInterfaceDetailW, SetupDiGetClassDevsW
shell32.dll	SHChangeNotification_Lock
ntdll.dll	NtClose, NtDuplicateObject
ntdll.dll	ZwQueryInformationProcess
gdiplus.dll	GdipDrawCachedBitmap, GdipMeasureDriverString, GdipDrawDriverString, GdipMeasureCharacterRanges, GdipMeasureString, GdipDrawString, GdipComment, GdipEndContainer, GdipBeginContainer2, GdipBeginContainerI, GdipBeginContainer, GdipRestoreGraphics, GdipSaveGraphics, GdipIsVisibleRectI, GdipIsVisibleRect, GdipIsVisiblePointI, GdipIsVisiblePoint, GdipIsVisibleClipEmpty, GdipGetVisibleClipBoundsI, GdipGetVisibleClipBounds, GdipIsClipEmpty, GdipGetClipBoundsI, GdipGetClipBounds, GdipGetClip, GdipTranslateClipI, GdipTranslateClip, GdipResetClip, GdipSetClipHrgn, GdipSetClipRegion, GdipSetClipPath, GdipSetClipRectI, GdipSetClipRect, GdipSetClipGraphics, GdipEnumerateMetafileSrcRectDestPointsI, GdipEnumerateMetafileSrcRectDestPoints, GdipEnumerateMetafileSrcRectDestRectI, GdipEnumerateMetafileSrcRectDestRect, GdipEnumerateMetafileSrcRectDestPointI, GdipEnumerateMetafileSrcRectDestPoint, GdipEnumerateMetafileDestPointsI, GdipEnumerateMetafileDestPoints, GdipEnumerateMetafileDestRectI, GdipEnumerateMetafileDestRect, GdipEnumerateMetafileDestPointI, GdipEnumerateMetafileDestPoint, GdipDrawImagePointsRectI, GdipDrawImagePointsRect, GdipDrawImageRectRectI, GdipDrawImageRectRect, GdipDrawImagePointRectI, GdipDrawImagePointRect, GdipDrawImagePointsI, GdipDrawImagePoints, GdipDrawImageRectI, GdipDrawImageRect, GdipDrawImageI, GdipDrawImage, GdipFillRegion, GdipFillClosedCurve2I, GdipFillClosedCurve2, GdipFillClosedCurveI, GdipFillClosedCurve, GdipFillPath, GdipFillPieI, GdipFillPie, GdipFillEllipseI, GdipFillEllipse, GdipFillPolygonI, GdipFillPolygon, GdipFillRectanglesI, GdipFillRectangles, GdipFillRectangleI, GdipFillRectangle, GdipGraphicsClear, GdipDrawClosedCurve2I, GdipDrawClosedCurve2, GdipDrawClosedCurveI, GdipDrawClosedCurve, GdipDrawCurve3I, GdipDrawCurve3, GdipDrawCurve2I, GdipDrawCurve2, GdipDrawCurveI, GdipDrawCurve, GdipDrawPath, GdipDrawPolygonI, GdipDrawPolygon, GdipDrawPieI, GdipDrawPie, GdipDrawEllipseI, GdipDrawEllipse, GdipDrawRectanglesI, GdipDrawRectangles, GdipDrawRectangleI, GdipDrawRectangle, GdipDrawBeziersI, GdipDrawBeziers, GdipDrawBezierI, GdipDrawBezier, GdipDrawArcI, GdipDrawArc, GdipDrawLinesI, GdipDrawLines, GdipDrawLineI, GdipDrawLine, GdipGetNearestColor, GdipTransformPointsI, GdipTransformPoints, GdipGetDpiY, GdipGetDpiX, GdipSetPageScale, GdipSetPageUnit, GdipGetPageScale, GdipGetPageUnit, GdipGetWorldTransform, GdipRotateWorldTransform, GdipScaleWorldTransform, GdipTranslateWorldTransform, GdipMultiplyWorldTransform, GdipResetWorldTransform, GdipSetWorldTransform, GdipGetInterpolationMode, GdipSetInterpolationMode, GdipGetTextContrast, GdipSetTextContrast, GdipGetTextRenderingHint, GdipSetTextRenderingHint, GdipGetPixelOffsetMode, GdipSetPixelOffsetMode, GdipGetSmoothingMode, GdipSetSmoothingMode, GdipGetCompositingQuality, GdipSetCompositingQuality, GdipGetRenderingOrigin, GdipSetRenderingOrigin, GdipGetCompositingMode, GdipSetCompositingMode, GdipReleaseDC, GdipGetDC, GdipDeleteGraphics, GdipCreateFromHWNDICM, GdipCreateFromHWND, GdipCreateFromHDC2, GdipCreateFromHDC, GdipFlush, GdipSetPropertyItem, GdipRemovePropertyItem, GdipGetAllPropertyItems, GdipGetPropertySize, GdipGetPropertyItem, GdipGetPropertyItemSize, GdipGetPropertyIdList, GdipGetPropertyCount, GdipGetImagePaletteSize, GdipSetImagePalette, GdipGetImagePalette, GdipImageRotateFlip, GdipImageSelectActiveFrame, GdipImageGetFrameCount, GdipImageGetFrameDimensionsList, GdipImageGetFrameDimensionsCount, GdipGetEncoderParameterList, GdipGetEncoderParameterListSize, GdipGetImageThumbnail, GdipGetImagePixelFormat, GdipGetImageRawFormat, GdipGetImageFlags, GdipGetImageVerticalResolution, GdipGetImageHorizontalResolution, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageType, GdipGetImageDimension, GdipGetImageBounds, GdipGetImageGraphicsContext, GdipSaveAddImage, GdipSaveAdd, GdipSaveImageToStream, GdipSaveImageToFile, GdipDisposeImage, GdipCloneImage, GdipLoadImageFromFileICM, GdipLoadImageFromStreamICM, GdipLoadImageFromFile, GdipLoadImageFromStream, GdipGetCustomLineCapWidthScale, GdipSetCustomLineCapWidthScale, GdipGetCustomLineCapBaseInset, GdipSetCustomLineCapBaseInset, GdipGetCustomLineCapBaseCap, GdipSetCustomLineCapBaseCap, GdipGetCustomLineCapStrokeJoin, GdipSetCustomLineCapStrokeJoin, GdipGetCustomLineCapStrokeCaps, GdipSetCustomLineCapStrokeCaps, GdipCloneCustomLineCap, GdipDeleteCustomLineCap, GdipCreateCustomLineCap, GdipGetPenCompoundArray, GdipSetPenCompoundArray, GdipGetPenCompoundCount, GdipGetPenDashArray, GdipSetPenDashArray, GdipGetPenDashCount, GdipSetPenDashOffset, GdipGetPenDashOffset, GdipSetPenDashStyle, GdipGetPenDashStyle, GdipGetPenFillType, GdipGetPenBrushFill, GdipSetPenBrushFill, GdipGetPenColor, GdipSetPenColor, GdipRotatePenTransform, GdipScalePenTransform, GdipTranslatePenTransform, GdipMultiplyPenTransform, GdipResetPenTransform, GdipGetPenTransform, GdipSetPenTransform, GdipGetPenMode, GdipSetPenMode, GdipGetPenMiterLimit, GdipSetPenMiterLimit, GdipGetPenCustomEndCap, GdipSetPenCustomEndCap, GdipGetPenCustomStartCap, GdipSetPenCustomStartCap, GdipGetPenLineJoin, GdipSetPenLineJoin, GdipGetPenDashCap197819, GdipGetPenEndCap, GdipGetPenStartCap, GdipSetPenDashCap197819, GdipSetPenEndCap, GdipSetPenStartCap, GdipSetPenLineCap197819, GdipGetPenWidth, GdipSetPenWidth, GdipDeletePen, GdipClonePen, GdipCreatePen2, GdipCreatePen1, GdipRotateLineTransform, GdipScaleLineTransform, GdipTranslateLineTransform, GdipMultiplyLineTransform, GdipResetLineTransform, GdipSetLineTransform, GdipGetLineTransform, GdipGetLineWrapMode, GdipSetLineWrapMode, GdipSetLineLinearBlend, GdipSetLineSigmaBlend, GdipSetLinePresetBlend, GdipGetLinePresetBlend, GdipGetLinePresetBlendCount, GdipSetLineBlend, GdipGetLineBlend, GdipGetLineBlendCount, GdipGetLineGammaCorrection, GdipSetLineGammaCorrection, GdipGetLineRectI, GdipGetLineRect, GdipGetLineColors, GdipSetLineColors, GdipCreateLineBrushFromRectWithAngleI, GdipCreateLineBrushFromRectWithAngle, GdipCreateLineBrushFromRectI, GdipCreateLineBrushFromRect, GdipCreateLineBrushI, GdipCreateLineBrush, GdipGetSolidFillColor, GdipSetSolidFillColor, GdipCreateSolidFill, GdipGetTextureImage, GdipGetTextureWrapMode, GdipSetTextureWrapMode, GdipRotateTextureTransform, GdipScaleTextureTransform, GdipTranslateTextureTransform, GdipMultiplyTextureTransform, GdipResetTextureTransform, GdipSetTextureTransform, GdipGetTextureTransform, GdipCreateTextureIAI, GdipCreateTexture2I, GdipCreateTextureIA, GdipCreateTexture2, GdipCreateTexture, GdipGetHatchBackgroundColor, GdipGetHatchForegroundColor, GdipGetHatchStyle, GdipCreateHatchBrush, GdipGetBrushType, GdipDeleteBrush, GdipCloneBrush, GdipGetRegionScansI, GdipGetRegionScans, GdipGetRegionScansCount, GdipIsVisibleRegionRectI, GdipIsVisibleRegionRect, GdipIsVisibleRegionPointI, GdipIsVisibleRegionPoint, GdipGetRegionData, GdipGetRegionDataSize, GdipIsEqualRegion, GdipIsInfiniteRegion, GdipIsEmptyRegion, GdipGetRegionHRgn, GdipGetRegionBoundsI, GdipGetRegionBounds, GdipTransformRegion, GdipTranslateRegionI, GdipTranslateRegion, GdipCombineRegionRegion, GdipCombineRegionPath, GdipCombineRegionRectI, GdipCombineRegionRect, GdipSetEmpty, GdipSetInfinite, GdipDeleteRegion, GdipCloneRegion, GdipCreateRegionHrgn, GdipCreateRegionRgnData, GdipCreateRegionPath, GdipCreateRegionRectI, GdipCreateRegionRect, GdipCreateRegion, GdipIsMatrixEqual, GdipIsMatrixIdentity, GdipIsMatrixInvertible, GdipGetMatrixElements, GdipVectorTransformMatrixPointsI, GdipVectorTransformMatrixPoints, GdipTransformMatrixPointsI, GdipTransformMatrixPoints, GdipInvertMatrix, GdipShearMatrix, GdipRotateMatrix, GdipScaleMatrix, GdipTranslateMatrix, GdipMultiplyMatrix, GdipSetMatrixElements, GdipDeleteMatrix, GdipCloneMatrix, GdipCreateMatrix3I, GdipCreateMatrix3, GdipCreateMatrix2, GdipCreateMatrix, GdipIsOutlineVisiblePathPointI, GdipIsOutlineVisiblePathPoint, GdipIsVisiblePathPointI, GdipIsVisiblePathPoint, GdipGetPathWorldBoundsI, GdipGetPathWorldBounds, GdipTransformPath, GdipWarpPath, GdipWidenPath, GdipWindingModeOutline, GdipFlattenPath, GdipAddPathPolygonI, GdipAddPathPieI, GdipAddPathEllipseI, GdipAddPathRectanglesI, GdipAddPathRectangleI, GdipAddPathClosedCurve2I, GdipAddPathClosedCurveI, GdipAddPathCurve3I, GdipAddPathCurve2I, GdipAddPathCurveI, GdipAddPathBeziersI, GdipAddPathBezierI, GdipAddPathArcI, GdipAddPathLine2I, GdipAddPathLineI, GdipAddPathStringI, GdipAddPathString, GdipAddPathPath, GdipAddPathPolygon, GdipAddPathPie, GdipAddPathEllipse, GdipAddPathRectangles, GdipAddPathRectangle, GdipAddPathClosedCurve2, GdipAddPathClosedCurve, GdipAddPathCurve3, GdipAddPathCurve2, GdipAddPathCurve, GdipAddPathBeziers, GdipAddPathBezier, GdipAddPathArc, GdipAddPathLine2, GdipAddPathLine, GdipGetPathLastPoint, GdipReversePath, GdipClearPathMarkers, GdipSetPathMarker, GdipClosePathFigures, GdipClosePathFigure, GdipStartPathFigure, GdipGetPathData, GdipSetPathFillMode, GdipGetPathFillMode, GdipGetPathPointsI, GdipGetPathPoints, GdipGetPathTypes, GdipGetPointCount, GdipResetPath, GdipDeletePath, GdipClonePath, GdipCreatePath2I, GdipCreatePath2, GdipCreatePath, GdiplusShutdown, GdiplusStartup, GdipFree, GdipAlloc
msimg32.dll	GradientFill
winhttp.dll	WinHttpCloseHandle, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpOpen
user32.dll	GetClassNameW, EnumThreadWindows, SetWindowLongW, InflateRect, SetWindowRgn, ReleaseDC, GetWindowDC, IsWindowEnabled, EnableWindow, IsWindowVisible, SetWindowPos, GetClassInfoW, PostMessageW
advapi32.dll	ChangeServiceConfig2W

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany
Russian	Russia

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 22:41:52.178081036 CET	54562	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:52.431972980 CET	53	54562	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:52.877453089 CET	52917	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:53.256027937 CET	53	52917	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:54.264229059 CET	62751	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:54.400695086 CET	53	62751	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:54.404386997 CET	57893	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:54.662106037 CET	53	57893	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:55.695888042 CET	54821	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:55.829957962 CET	53	54821	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:55.833795071 CET	54719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:55.968130112 CET	53	54719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:56.977067947 CET	49881	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:57.230364084 CET	53	49881	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:57.329600096 CET	54998	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:57.465087891 CET	53	54998	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:58.472569942 CET	52781	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:58.614516020 CET	53	52781	8.8.8.8	192.168.2.22
Nov 20, 2024 22:41:58.617953062 CET	63926	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:41:58.992527008 CET	53	63926	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:00.005224943 CET	65510	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:00.380234003 CET	53	65510	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:00.392776966 CET	62672	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:00.527204037 CET	53	62672	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:01.529712915 CET	56475	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:01.665671110 CET	53	56475	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:01.828950882 CET	49384	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:01.963444948 CET	53	49384	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:02.990683079 CET	54842	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:03.125463963 CET	53	54842	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:03.140675068 CET	58105	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:03.274781942 CET	53	58105	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:04.381591082 CET	64928	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:04.516789913 CET	53	64928	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:04.535044909 CET	57390	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:04.659235954 CET	53	57390	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:05.663636923 CET	58095	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:05.797663927 CET	53	58095	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:05.799801111 CET	54261	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:05.922481060 CET	53	54261	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:06.957926035 CET	60507	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:07.092246056 CET	53	60507	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:07.095196962 CET	50446	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:07.230650902 CET	53	50446	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:08.237298012 CET	55939	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:08.359872103 CET	53	55939	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:08.365088940 CET	49608	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:08.499254942 CET	53	49608	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:09.500956059 CET	61486	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:09.623641968 CET	53	61486	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:09.625911951 CET	62453	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:09.759814024 CET	53	62453	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:10.864537001 CET	50568	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:10.998703957 CET	53	50568	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:11.351821899 CET	61467	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:11.486599922 CET	53	61467	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:12.513428926 CET	61618	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:12.647360086 CET	53	61618	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:12.649547100 CET	54422	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:12.783776045 CET	53	54422	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:13.793076038 CET	52074	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:13.927376986 CET	53	52074	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:14.105748892 CET	50337	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:14.239641905 CET	53	50337	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:15.295449972 CET	61826	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:15.418344021 CET	53	61826	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:15.420433998 CET	56329	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:15.554037094 CET	53	56329	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:16.567660093 CET	63469	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:16.702367067 CET	53	63469	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:16.704500914 CET	59447	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:16.838324070 CET	53	59447	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:17.866483927 CET	51828	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:18.000422955 CET	53	51828	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:18.006992102 CET	53406	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:18.140925884 CET	53	53406	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:19.158682108 CET	56345	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:19.293194056 CET	53	56345	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:19.295794964 CET	51870	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:19.431806087 CET	53	51870	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:20.493295908 CET	65009	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:20.615936995 CET	53	65009	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:20.710217953 CET	64956	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:20.844183922 CET	53	64956	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:21.861198902 CET	54521	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:21.989571095 CET	53	54521	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:21.992259979 CET	49750	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:22.121160984 CET	53	49750	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:23.137077093 CET	64687	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:23.259655952 CET	53	64687	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:23.261719942 CET	65084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:23.395432949 CET	53	65084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:24.405260086 CET	63373	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:24.539165020 CET	53	63373	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:24.600804090 CET	56207	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:24.734977007 CET	53	56207	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:25.741007090 CET	51955	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:25.875937939 CET	53	51955	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:25.879163980 CET	58971	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:26.002310038 CET	53	58971	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:27.022233009 CET	51014	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:27.156604052 CET	53	51014	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:27.159246922 CET	49690	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:27.293692112 CET	53	49690	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:28.312661886 CET	60169	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:28.435700893 CET	53	60169	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:28.438308001 CET	53060	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:28.574589968 CET	53	53060	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:29.578263044 CET	49949	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:29.700963020 CET	53	49949	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:29.707176924 CET	54027	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:29.829909086 CET	53	54027	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:30.841684103 CET	63950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:30.975548029 CET	53	63950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:31.111491919 CET	58257	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:31.245528936 CET	53	58257	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:32.261615038 CET	54738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:32.636847019 CET	53	54738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:32.639065027 CET	49478	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:32.761826038 CET	53	49478	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:33.777429104 CET	49288	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:33.912204027 CET	53	49288	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:33.918979883 CET	61598	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:34.052933931 CET	53	61598	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:35.555509090 CET	58754	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:35.689363956 CET	53	58754	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:35.809771061 CET	49226	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:35.943526030 CET	53	49226	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:36.956923962 CET	54695	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:37.090899944 CET	53	54695	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:37.093483925 CET	61601	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:37.227264881 CET	53	61601	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:38.212934017 CET	54615	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:38.338301897 CET	53	54615	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:38.340447903 CET	54950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:38.475222111 CET	53	54950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:39.406939983 CET	64215	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:39.529563904 CET	53	64215	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:39.531995058 CET	59604	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:39.666404009 CET	53	59604	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:40.560913086 CET	49520	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:40.684324026 CET	53	49520	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:40.687902927 CET	53031	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:40.822143078 CET	53	53031	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:41.688559055 CET	53112	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:41.812490940 CET	53	53112	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:41.814784050 CET	65080	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:41.948679924 CET	53	65080	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:42.890582085 CET	50702	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:43.013253927 CET	53	50702	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:43.054187059 CET	53089	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:43.176740885 CET	53	53089	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:43.993132114 CET	51951	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:44.127194881 CET	53	51951	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:44.129650116 CET	61549	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:44.263508081 CET	53	61549	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:45.079973936 CET	57998	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:45.214241982 CET	53	57998	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:45.216595888 CET	62439	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:45.339287996 CET	53	62439	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:46.145133018 CET	59432	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:46.279623032 CET	53	59432	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:46.302201986 CET	55910	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:46.439644098 CET	53	55910	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:47.190989017 CET	61564	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:47.325125933 CET	53	61564	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:47.327231884 CET	51384	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:47.449986935 CET	53	51384	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:48.157860041 CET	53785	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:48.291904926 CET	53	53785	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:48.298299074 CET	55277	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:48.421120882 CET	53	55277	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:49.128974915 CET	51183	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:49.263103962 CET	53	51183	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:49.263531923 CET	51183	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:49.397573948 CET	53	51183	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:49.400122881 CET	57027	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:49.534318924 CET	53	57027	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:50.201313019 CET	50380	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:50.337368965 CET	53	50380	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:50.339848995 CET	56156	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:50.462863922 CET	53	56156	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:50.463481903 CET	56156	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:50.586500883 CET	53	56156	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:51.234951019 CET	60971	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:51.369119883 CET	53	60971	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:51.369558096 CET	60971	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:51.504126072 CET	53	60971	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:51.506786108 CET	56308	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:51.629565001 CET	53	56308	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:52.246423006 CET	51268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:52.380521059 CET	53	51268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:52.387197971 CET	59475	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:52.521677971 CET	53	59475	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:52.521939993 CET	59475	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:52.644329071 CET	53	59475	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.247814894 CET	62930	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:53.370729923 CET	53	62930	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.371134043 CET	62930	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:53.506714106 CET	53	62930	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.507003069 CET	62930	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:53.641697884 CET	53	62930	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.643922091 CET	61008	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:53.766540051 CET	53	61008	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.767092943 CET	61008	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:53.889513969 CET	53	61008	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:53.889765978 CET	61008	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:54.023660898 CET	53	61008	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:54.621337891 CET	59514	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:54.756026030 CET	53	59514	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:54.756577015 CET	59514	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:54.879458904 CET	53	59514	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:54.879750013 CET	59514	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:55.002635956 CET	53	59514	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:55.002918959 CET	59514	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:55.136879921 CET	53	59514	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:55.137242079 CET	59514	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:55.260034084 CET	53	59514	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:55.839569092 CET	53077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:55.974057913 CET	53	53077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:55.974441051 CET	53077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.108884096 CET	53	53077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.109126091 CET	53077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.248675108 CET	53	53077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.248874903 CET	53077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.371551037 CET	53	53077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.371798992 CET	53077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.494354963 CET	53	53077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.724948883 CET	53188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.854645967 CET	53	53188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.854937077 CET	53188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:56.981245041 CET	53	53188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:56.981636047 CET	53188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:57.104185104 CET	53	53188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:57.104664087 CET	53188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:57.239001036 CET	53	53188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:42:57.239219904 CET	53188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:42:57.361891031 CET	53	53188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.018363953 CET	54333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.153100967 CET	53	54333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.153340101 CET	54333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.287298918 CET	53	54333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.287604094 CET	54333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.421627998 CET	53	54333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.421988964 CET	54333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.544487000 CET	53	54333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.544776917 CET	54333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.679706097 CET	53	54333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.807095051 CET	55388	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:00.941643953 CET	53	55388	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:00.942038059 CET	55388	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:01.076697111 CET	53	55388	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:01.080085039 CET	55388	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:01.203183889 CET	53	55388	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:01.203516006 CET	55388	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:01.337450027 CET	53	55388	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:01.337701082 CET	55388	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:01.461675882 CET	53	55388	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:02.108731031 CET	60624	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:02.231494904 CET	53	60624	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:02.232745886 CET	60624	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:02.356153965 CET	53	60624	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:02.356336117 CET	60624	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:02.480146885 CET	53	60624	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:02.627207994 CET	60624	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:02.750086069 CET	53	60624	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:02.777544022 CET	60624	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:02.900099039 CET	53	60624	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:03.314477921 CET	58974	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:03.457032919 CET	53	58974	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:03.457221985 CET	58974	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:03.594933033 CET	53	58974	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:03.595227003 CET	58974	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:03.729274035 CET	53	58974	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:03.736116886 CET	58974	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:03.870822906 CET	53	58974	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:03.871045113 CET	58974	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:03.993731976 CET	53	58974	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.012136936 CET	54154	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.146296978 CET	53	54154	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.147504091 CET	54154	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.269953012 CET	53	54154	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.270172119 CET	54154	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.392730951 CET	53	54154	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.392909050 CET	54154	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.515546083 CET	53	54154	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.519504070 CET	54154	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.653959990 CET	53	54154	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.663053989 CET	53602	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.785486937 CET	53	53602	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.785742044 CET	53602	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:05.919601917 CET	53	53602	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:05.919832945 CET	53602	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:06.054390907 CET	53	53602	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:06.054613113 CET	53602	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:06.188316107 CET	53	53602	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:06.188560963 CET	53602	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:06.311431885 CET	53	53602	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:07.543968916 CET	49263	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:07.678056955 CET	53	49263	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:07.678258896 CET	49263	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:07.803078890 CET	53	49263	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:07.805695057 CET	49263	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:07.939773083 CET	53	49263	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:07.940043926 CET	49263	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.062969923 CET	53	49263	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.063170910 CET	49263	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.200922012 CET	53	49263	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.207232952 CET	60981	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.346704960 CET	53	60981	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.346889019 CET	60981	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.471338987 CET	53	60981	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.471538067 CET	60981	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.594064951 CET	53	60981	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.594271898 CET	60981	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.728379011 CET	53	60981	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:08.728594065 CET	60981	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:08.851114988 CET	53	60981	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.242084026 CET	51161	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:11.364995003 CET	53	51161	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.365214109 CET	51161	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:11.498837948 CET	53	51161	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.499047995 CET	51161	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:11.621973991 CET	53	51161	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.622147083 CET	51161	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:11.756143093 CET	53	51161	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.756352901 CET	51161	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:11.879769087 CET	53	51161	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:11.889925957 CET	50357	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:12.023825884 CET	53	50357	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:12.024179935 CET	50357	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:12.146699905 CET	53	50357	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:12.151612043 CET	50357	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:12.274094105 CET	53	50357	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:12.274363041 CET	50357	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:12.408231020 CET	53	50357	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:12.410607100 CET	50357	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:12.533163071 CET	53	50357	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:13.625560999 CET	58291	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:13.749182940 CET	53	58291	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:13.749381065 CET	58291	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:13.871711016 CET	53	58291	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:13.871912003 CET	58291	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:13.994494915 CET	53	58291	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:13.994770050 CET	58291	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:14.130023003 CET	53	58291	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:14.130337000 CET	58291	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:14.254587889 CET	53	58291	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:14.595616102 CET	52129	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:14.732043028 CET	53	52129	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:14.735516071 CET	52129	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:14.858118057 CET	53	52129	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:14.863482952 CET	52129	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:14.997312069 CET	53	52129	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:14.997616053 CET	52129	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:15.120069981 CET	53	52129	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:15.120296955 CET	52129	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:15.242950916 CET	53	52129	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:16.259721994 CET	60122	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:16.382205009 CET	53	60122	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:16.389806032 CET	60122	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:16.512799025 CET	53	60122	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:16.513123035 CET	60122	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:16.648135900 CET	53	60122	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:16.648363113 CET	60122	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:16.770747900 CET	53	60122	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:16.770972967 CET	60122	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:16.893357992 CET	53	60122	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:17.910284042 CET	64762	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.045054913 CET	53	64762	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.045274973 CET	64762	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.167881012 CET	53	64762	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.173948050 CET	64762	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.296668053 CET	53	64762	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.297034979 CET	64762	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.432703972 CET	53	64762	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.432872057 CET	64762	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.556504965 CET	53	64762	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.565253019 CET	53063	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.699496984 CET	53	53063	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.699701071 CET	53063	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.822340012 CET	53	53063	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.822510004 CET	53063	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:18.957133055 CET	53	53063	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:18.957431078 CET	53063	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:19.080952883 CET	53	53063	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:19.081163883 CET	53063	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:19.204739094 CET	53	53063	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.221957922 CET	60333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:20.344644070 CET	53	60333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.346432924 CET	60333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:20.481385946 CET	53	60333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.481755972 CET	60333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:20.605108023 CET	53	60333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.607671976 CET	60333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:20.729974985 CET	53	60333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.735658884 CET	60333	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:20.859123945 CET	53	60333	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:20.872279882 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:21.006352901 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:21.006738901 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:21.129482985 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:21.129731894 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:21.252868891 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:21.253062010 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:21.387880087 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:21.388082981 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:21.512440920 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:22.531056881 CET	56243	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:22.653798103 CET	53	56243	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:22.654422998 CET	56243	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:22.777791977 CET	53	56243	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:22.778053045 CET	56243	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:22.900562048 CET	53	56243	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:22.900840998 CET	56243	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:23.023722887 CET	53	56243	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:23.023947954 CET	56243	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:23.146385908 CET	53	56243	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.169333935 CET	62689	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.291918039 CET	53	62689	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.292128086 CET	62689	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.426892996 CET	53	62689	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.427088022 CET	62689	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.561189890 CET	53	62689	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.561355114 CET	62689	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.683720112 CET	53	62689	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.683900118 CET	62689	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.817488909 CET	53	62689	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.825582027 CET	49339	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:24.959566116 CET	53	49339	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:24.966341019 CET	49339	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:25.088916063 CET	53	49339	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:25.089076996 CET	49339	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:25.211483002 CET	53	49339	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:25.211643934 CET	49339	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:25.334090948 CET	53	49339	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:25.334248066 CET	49339	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:25.457027912 CET	53	49339	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:26.482256889 CET	60994	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:26.605986118 CET	53	60994	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:26.610050917 CET	60994	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:26.744479895 CET	53	60994	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:26.745857000 CET	60994	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:26.879728079 CET	53	60994	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:26.882097960 CET	60994	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.005590916 CET	53	60994	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:27.008996964 CET	60994	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.131699085 CET	53	60994	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:27.137888908 CET	63720	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.260303020 CET	53	63720	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:27.260469913 CET	63720	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.384027958 CET	53	63720	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:27.384191990 CET	63720	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.506548882 CET	53	63720	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:27.506701946 CET	63720	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:27.630750895 CET	53	63720	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:28.646064997 CET	62131	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:28.779903889 CET	53	62131	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:28.780203104 CET	62131	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:28.902851105 CET	53	62131	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:28.903012037 CET	62131	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:29.025384903 CET	53	62131	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:29.025681973 CET	62131	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:29.149967909 CET	53	62131	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:29.150170088 CET	62131	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:29.272416115 CET	53	62131	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.280647039 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:30.420665979 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.420833111 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:30.543234110 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.546801090 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:30.669203043 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.669404984 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:30.791924000 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.792144060 CET	63036	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:30.927369118 CET	53	63036	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:30.932365894 CET	63535	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:31.055085897 CET	53	63535	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:31.055270910 CET	63535	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:31.177826881 CET	53	63535	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:31.178003073 CET	63535	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:31.311970949 CET	53	63535	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:31.312149048 CET	63535	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:31.445806980 CET	53	63535	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:31.446024895 CET	63535	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:31.568557024 CET	53	63535	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:32.608330965 CET	55219	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:32.730954885 CET	53	55219	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:32.731682062 CET	55219	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:32.854151964 CET	53	55219	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:32.855667114 CET	55219	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:32.978256941 CET	53	55219	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:32.978514910 CET	55219	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.101578951 CET	53	55219	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.102035999 CET	55219	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.236594915 CET	53	55219	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.245883942 CET	60228	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.368514061 CET	53	60228	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.368700981 CET	60228	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.492146969 CET	53	60228	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.492316961 CET	60228	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.627728939 CET	53	60228	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.627875090 CET	60228	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.752286911 CET	53	60228	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:33.752496004 CET	60228	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:33.875696898 CET	53	60228	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:34.887566090 CET	58671	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.021940947 CET	53	58671	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.022159100 CET	58671	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.144655943 CET	53	58671	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.144974947 CET	58671	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.278908968 CET	53	58671	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.279059887 CET	58671	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.414623976 CET	53	58671	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.414786100 CET	58671	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.537419081 CET	53	58671	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.545502901 CET	56415	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.668302059 CET	53	56415	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.668457985 CET	56415	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.790932894 CET	53	56415	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.791148901 CET	56415	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:35.925452948 CET	53	56415	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:35.925611973 CET	56415	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:36.060328960 CET	53	56415	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:36.060499907 CET	56415	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:36.182919979 CET	53	56415	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.195960999 CET	50124	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.319344997 CET	53	50124	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.319506884 CET	50124	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.442274094 CET	53	50124	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.442449093 CET	50124	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.564979076 CET	53	50124	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.565136909 CET	50124	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.687589884 CET	53	50124	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.687767982 CET	50124	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.810440063 CET	53	50124	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.815332890 CET	63434	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:37.938029051 CET	53	63434	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:37.938215971 CET	63434	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:38.060688019 CET	53	63434	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:38.060836077 CET	63434	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:38.183922052 CET	53	63434	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:38.184243917 CET	63434	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:38.306845903 CET	53	63434	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:38.307080984 CET	63434	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:38.433146954 CET	53	63434	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:39.478595972 CET	58147	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:39.604455948 CET	53	58147	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:39.604631901 CET	58147	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:39.739085913 CET	53	58147	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:39.739245892 CET	58147	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:39.862004995 CET	53	58147	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:39.862174034 CET	58147	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:39.985254049 CET	53	58147	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:39.985402107 CET	58147	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:40.108423948 CET	53	58147	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.122827053 CET	57113	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.248157978 CET	53	57113	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.248351097 CET	57113	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.370790005 CET	53	57113	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.370959044 CET	57113	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.493860006 CET	53	57113	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.494081020 CET	57113	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.619359970 CET	53	57113	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.619532108 CET	57113	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.742048025 CET	53	57113	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.759449005 CET	58254	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:41.893444061 CET	53	58254	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:41.893632889 CET	58254	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:42.028009892 CET	53	58254	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:42.028276920 CET	58254	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:42.150815964 CET	53	58254	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:42.159571886 CET	58254	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:42.294893026 CET	53	58254	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:42.303679943 CET	58254	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:42.426263094 CET	53	58254	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:43.435604095 CET	61783	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:43.558460951 CET	53	61783	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:43.558629990 CET	61783	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:43.682627916 CET	53	61783	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:43.682840109 CET	61783	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:43.806229115 CET	53	61783	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:43.806402922 CET	61783	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:43.928996086 CET	53	61783	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:43.929265022 CET	61783	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:44.052225113 CET	53	61783	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:44.060718060 CET	58322	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:44.195127964 CET	53	58322	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:45.215846062 CET	57607	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:45.338706017 CET	53	57607	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:45.338937998 CET	57607	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:45.463274002 CET	53	57607	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:45.463455915 CET	57607	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:45.594656944 CET	53	57607	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:45.595027924 CET	57607	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:45.724842072 CET	53	57607	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:45.725033998 CET	57607	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:45.847577095 CET	53	57607	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:46.855588913 CET	53681	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:46.997525930 CET	53	53681	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:46.997787952 CET	53681	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:47.131943941 CET	53	53681	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:47.132141113 CET	53681	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:47.270015955 CET	53	53681	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:47.270237923 CET	53681	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:47.395678997 CET	53	53681	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:47.395850897 CET	53681	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:47.522660017 CET	53	53681	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:48.536408901 CET	57693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:48.679672003 CET	53	57693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:48.679987907 CET	57693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:48.817967892 CET	53	57693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:48.818293095 CET	57693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:48.943913937 CET	53	57693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:48.944180012 CET	57693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:49.082175970 CET	53	57693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:49.082565069 CET	57693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:49.210656881 CET	53	57693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:49.619656086 CET	54052	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:49.742590904 CET	53	54052	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:49.789527893 CET	54052	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:49.923723936 CET	53	54052	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:49.942755938 CET	54052	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:50.065670013 CET	53	54052	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:50.098722935 CET	54052	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:50.233354092 CET	53	54052	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:50.233591080 CET	54052	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:50.367485046 CET	53	54052	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:51.394714117 CET	62431	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:51.518030882 CET	53	62431	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:51.519958973 CET	62431	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:51.642975092 CET	53	62431	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:51.643131971 CET	62431	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:51.774154902 CET	53	62431	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:51.774300098 CET	62431	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:51.898730040 CET	53	62431	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:51.898921967 CET	62431	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.021503925 CET	53	62431	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:52.029953957 CET	52772	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.156286001 CET	53	52772	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:52.159743071 CET	52772	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.282573938 CET	53	52772	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:52.283070087 CET	52772	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.405766964 CET	53	52772	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:52.405934095 CET	52772	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.529890060 CET	53	52772	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:52.531713963 CET	52772	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:52.666445971 CET	53	52772	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:53.827788115 CET	59180	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:53.961714983 CET	53	59180	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:53.964926004 CET	59180	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.099648952 CET	53	59180	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.103713036 CET	59180	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.226552963 CET	53	59180	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.226705074 CET	59180	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.349220991 CET	53	59180	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.351814985 CET	59180	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.485754013 CET	53	59180	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.492530107 CET	53558	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.615168095 CET	53	53558	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.615362883 CET	53558	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.737876892 CET	53	53558	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.738064051 CET	53558	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.872116089 CET	53	53558	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.872292995 CET	53558	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:54.994762897 CET	53	53558	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:54.997066975 CET	53558	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:55.130951881 CET	53	53558	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.149772882 CET	59120	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.272452116 CET	53	59120	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.275778055 CET	59120	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.411185026 CET	53	59120	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.411724091 CET	59120	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.546113968 CET	53	59120	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.547841072 CET	59120	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.673608065 CET	53	59120	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.676057100 CET	59120	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.798616886 CET	53	59120	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.814810991 CET	54670	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:56.953457117 CET	53	54670	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:56.953620911 CET	54670	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:57.079171896 CET	53	54670	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:57.079387903 CET	54670	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:57.201944113 CET	53	54670	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:57.202267885 CET	54670	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:57.326010942 CET	53	54670	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:57.326184034 CET	54670	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:57.457530022 CET	53	54670	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:58.475044012 CET	54450	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:58.597589970 CET	53	54450	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:58.597810030 CET	54450	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:58.731633902 CET	53	54450	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:58.731801987 CET	54450	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:58.854231119 CET	53	54450	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:58.855751038 CET	54450	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:58.978138924 CET	53	54450	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:58.979818106 CET	54450	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.102396011 CET	53	54450	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:59.116810083 CET	53959	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.239480019 CET	53	53959	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:59.239728928 CET	53959	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.368835926 CET	53	53959	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:59.368987083 CET	53959	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.491440058 CET	53	53959	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:59.491592884 CET	53959	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.622318029 CET	53	53959	8.8.8.8	192.168.2.22
Nov 20, 2024 22:43:59.622474909 CET	53959	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:43:59.746536016 CET	53	53959	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:00.764117956 CET	64952	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:00.888556957 CET	53	64952	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:00.888775110 CET	64952	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.011483908 CET	53	64952	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.011672974 CET	64952	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.134367943 CET	53	64952	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.134578943 CET	64952	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.257105112 CET	53	64952	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.257286072 CET	64952	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.379941940 CET	53	64952	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.390852928 CET	63716	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.513379097 CET	53	63716	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.517911911 CET	63716	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.640458107 CET	53	63716	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.642142057 CET	63716	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.776451111 CET	53	63716	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.776952982 CET	63716	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:01.911791086 CET	53	63716	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:01.912003040 CET	63716	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:02.034779072 CET	53	63716	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:03.403675079 CET	61327	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:03.529063940 CET	53	61327	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:03.529376984 CET	61327	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:03.654042959 CET	53	61327	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:03.654721022 CET	61327	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:03.781807899 CET	53	61327	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:03.782166958 CET	61327	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:03.905457973 CET	53	61327	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:03.905885935 CET	61327	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.028680086 CET	53	61327	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:04.040992022 CET	63892	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.163832903 CET	53	63892	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:04.164057970 CET	63892	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.300276995 CET	53	63892	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:04.300533056 CET	63892	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.423193932 CET	53	63892	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:04.423429966 CET	63892	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.545929909 CET	53	63892	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:04.546495914 CET	63892	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:04.680437088 CET	53	63892	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:06.866760015 CET	62151	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:06.989500999 CET	53	62151	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:07.002222061 CET	62151	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:07.124769926 CET	53	62151	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:07.125026941 CET	62151	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:07.247468948 CET	53	62151	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:07.247826099 CET	62151	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:07.370964050 CET	53	62151	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:07.375583887 CET	62151	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:07.498570919 CET	53	62151	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:08.523107052 CET	61502	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:08.657845020 CET	53	61502	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:08.658483028 CET	61502	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:08.781183958 CET	53	61502	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:08.781433105 CET	61502	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:08.905586958 CET	53	61502	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:08.905966997 CET	61502	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.028879881 CET	53	61502	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.029133081 CET	61502	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.151642084 CET	53	61502	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.189661980 CET	55359	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.312093019 CET	53	55359	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.312443018 CET	55359	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.437042952 CET	53	55359	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.465585947 CET	55359	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.588213921 CET	53	55359	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.590342045 CET	55359	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.713021040 CET	53	55359	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:09.713236094 CET	55359	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:09.837533951 CET	53	55359	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:10.889831066 CET	59419	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.014448881 CET	53	59419	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.014687061 CET	59419	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.149418116 CET	53	59419	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.149755001 CET	59419	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.272964954 CET	53	59419	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.273473024 CET	59419	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.407804966 CET	53	59419	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.408061028 CET	59419	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.534481049 CET	53	59419	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.542824030 CET	52165	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.665518999 CET	53	52165	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.665693998 CET	52165	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.788398027 CET	53	52165	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.788584948 CET	52165	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:11.917915106 CET	53	52165	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:11.918217897 CET	52165	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:12.041671991 CET	53	52165	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:12.041860104 CET	52165	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:12.164858103 CET	53	52165	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:13.183593988 CET	61364	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:13.310832024 CET	53	61364	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:13.311965942 CET	61364	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:13.441665888 CET	53	61364	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:13.443839073 CET	61364	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:13.575656891 CET	53	61364	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:13.575830936 CET	61364	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:13.707175016 CET	53	61364	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:13.707338095 CET	61364	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:13.836424112 CET	53	61364	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:14.856596947 CET	50656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:14.987767935 CET	53	50656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:14.987962008 CET	50656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.114514112 CET	53	50656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.114727974 CET	50656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.239378929 CET	53	50656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.239554882 CET	50656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.362062931 CET	53	50656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.362791061 CET	50656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.492302895 CET	53	50656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.502481937 CET	61321	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.645126104 CET	53	61321	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.645324945 CET	61321	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.773758888 CET	53	61321	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.774894953 CET	61321	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:15.897710085 CET	53	61321	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:15.903855085 CET	61321	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:16.030045033 CET	53	61321	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:16.035847902 CET	61321	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:16.170331001 CET	53	61321	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:17.612345934 CET	54712	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:17.734972000 CET	53	54712	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:17.740286112 CET	54712	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:17.862714052 CET	53	54712	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:17.900887966 CET	54712	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.035240889 CET	53	54712	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.093208075 CET	54712	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.215979099 CET	53	54712	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.216161966 CET	54712	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.350111961 CET	53	54712	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.372128010 CET	60864	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.494816065 CET	53	60864	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.495100975 CET	60864	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.617897034 CET	53	60864	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.618091106 CET	60864	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.741385937 CET	53	60864	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.741580963 CET	60864	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.864206076 CET	53	60864	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:18.864559889 CET	60864	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:18.986943007 CET	53	60864	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:20.001494884 CET	59728	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:20.124531031 CET	53	59728	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:20.125878096 CET	59728	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:20.248928070 CET	53	59728	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:20.251835108 CET	59728	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:20.374905109 CET	53	59728	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:20.375190973 CET	59728	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:20.497698069 CET	53	59728	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:20.512850046 CET	59728	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:20.647265911 CET	53	59728	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:21.117292881 CET	64002	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:21.239975929 CET	53	64002	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:21.240185976 CET	64002	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:21.362984896 CET	53	64002	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:21.363250017 CET	64002	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:21.486278057 CET	53	64002	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:21.486479998 CET	64002	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:21.610176086 CET	53	64002	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:21.610527039 CET	64002	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:21.733169079 CET	53	64002	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:22.748413086 CET	63738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:22.871078968 CET	53	63738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:22.871386051 CET	63738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:22.993879080 CET	53	63738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:22.994056940 CET	63738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.119862080 CET	53	63738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.120084047 CET	63738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.245556116 CET	53	63738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.247848988 CET	63738	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.370384932 CET	53	63738	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.380634069 CET	59944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.503412008 CET	53	59944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.503938913 CET	59944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.627063990 CET	53	59944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.627871990 CET	59944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.750665903 CET	53	59944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.750891924 CET	59944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.873616934 CET	53	59944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:23.873907089 CET	59944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:23.996576071 CET	53	59944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.014368057 CET	51107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.137461901 CET	53	51107	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.137654066 CET	51107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.272391081 CET	53	51107	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.272618055 CET	51107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.397408962 CET	53	51107	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.397660971 CET	51107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.520102978 CET	53	51107	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.520303011 CET	51107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.642782927 CET	53	51107	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.656306982 CET	61084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.779055119 CET	53	61084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.779247046 CET	61084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:25.902579069 CET	53	61084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:25.902868032 CET	61084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:26.025566101 CET	53	61084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:26.025809050 CET	61084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:26.148614883 CET	53	61084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:26.148830891 CET	61084	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:26.271863937 CET	53	61084	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.285923958 CET	63255	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:27.412185907 CET	53	63255	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.415860891 CET	63255	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:27.544063091 CET	53	63255	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.547797918 CET	63255	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:27.672327042 CET	53	63255	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.675796032 CET	63255	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:27.798394918 CET	53	63255	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.798605919 CET	63255	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:27.921849966 CET	53	63255	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:27.931160927 CET	56640	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:28.054641008 CET	53	56640	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:28.129537106 CET	56640	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:28.256736994 CET	53	56640	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:28.256927967 CET	56640	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:28.384910107 CET	53	56640	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:28.389214993 CET	56640	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:28.511723995 CET	53	56640	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:28.515813112 CET	56640	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:28.639990091 CET	53	56640	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:29.657263994 CET	51692	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:29.785737991 CET	53	51692	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:29.786073923 CET	51692	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:29.915658951 CET	53	51692	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:29.916136980 CET	51692	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.038935900 CET	53	51692	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.039127111 CET	51692	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.172885895 CET	53	51692	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.173183918 CET	51692	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.297538042 CET	53	51692	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.305824041 CET	53134	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.428673029 CET	53	53134	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.428847075 CET	53134	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.551529884 CET	53	53134	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.551687956 CET	53134	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.674355030 CET	53	53134	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.674556971 CET	53134	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.798356056 CET	53	53134	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:30.800564051 CET	53134	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:30.924803972 CET	53	53134	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:31.933330059 CET	54963	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.055943012 CET	53	54963	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.056288004 CET	54963	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.178853035 CET	53	54963	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.179048061 CET	54963	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.312932014 CET	53	54963	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.315897942 CET	54963	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.438555002 CET	53	54963	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.443922997 CET	54963	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.566488028 CET	53	54963	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.575983047 CET	60970	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.698543072 CET	53	60970	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.699886084 CET	60970	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.823822021 CET	53	60970	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.827836990 CET	60970	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:32.964035988 CET	53	60970	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:32.968111992 CET	60970	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:33.092318058 CET	53	60970	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:33.092612028 CET	60970	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:33.218278885 CET	53	60970	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:34.234373093 CET	59181	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:34.370702028 CET	53	59181	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:34.370945930 CET	59181	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:34.495166063 CET	53	59181	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:34.495325089 CET	59181	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:34.617899895 CET	53	59181	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:34.618062019 CET	59181	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:34.742191076 CET	53	59181	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:34.742396116 CET	59181	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:34.871597052 CET	53	59181	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:35.898603916 CET	56050	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:36.026427031 CET	53	56050	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:36.026633024 CET	56050	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:36.154664040 CET	53	56050	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:36.155862093 CET	56050	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:36.282082081 CET	53	56050	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:36.284112930 CET	56050	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:36.426525116 CET	53	56050	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:36.428117037 CET	56050	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:36.551413059 CET	53	56050	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:37.567173004 CET	62143	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:37.698072910 CET	53	62143	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:37.699887991 CET	62143	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:37.823875904 CET	53	62143	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:37.826081991 CET	62143	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:37.953643084 CET	53	62143	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:37.955776930 CET	62143	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.084641933 CET	53	62143	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.087807894 CET	62143	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.219140053 CET	53	62143	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.227783918 CET	60315	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.355882883 CET	53	60315	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.356106043 CET	60315	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.482482910 CET	53	60315	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.482691050 CET	60315	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.605319977 CET	53	60315	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.605516911 CET	60315	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.728607893 CET	53	60315	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:38.728790045 CET	60315	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:38.851308107 CET	53	60315	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:39.857471943 CET	49719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:39.982500076 CET	53	49719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:39.982702971 CET	49719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:40.105588913 CET	53	49719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:40.105894089 CET	49719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:40.229223013 CET	53	49719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:40.229937077 CET	49719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:40.352989912 CET	53	49719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:40.353914976 CET	49719	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:40.478219032 CET	53	49719	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:41.509021997 CET	59876	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:41.636734962 CET	53	59876	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:41.637342930 CET	59876	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:41.759974003 CET	53	59876	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:41.768879890 CET	59876	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:41.891719103 CET	53	59876	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:41.892949104 CET	59876	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.017198086 CET	53	59876	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.017401934 CET	59876	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.147921085 CET	53	59876	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.182602882 CET	64787	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.312752008 CET	53	64787	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.312939882 CET	64787	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.435724020 CET	53	64787	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.437978029 CET	64787	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.574317932 CET	53	64787	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.577995062 CET	64787	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.701142073 CET	53	64787	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:42.703809977 CET	64787	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:42.828346014 CET	53	64787	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:43.850754976 CET	52249	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:43.973191977 CET	53	52249	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:43.973496914 CET	52249	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.096481085 CET	53	52249	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.096774101 CET	52249	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.219630003 CET	53	52249	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.219955921 CET	52249	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.342411041 CET	53	52249	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.342617989 CET	52249	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.477654934 CET	53	52249	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.487968922 CET	64872	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.610774994 CET	53	64872	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.610951900 CET	64872	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.733381987 CET	53	64872	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.733576059 CET	64872	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.856194973 CET	53	64872	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.857284069 CET	64872	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:44.980159044 CET	53	64872	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:44.980389118 CET	64872	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:45.103600979 CET	53	64872	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.116460085 CET	55188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.239038944 CET	53	55188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.242058039 CET	55188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.365514994 CET	53	55188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.365833044 CET	55188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.495771885 CET	53	55188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.497886896 CET	55188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.620882988 CET	53	55188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.621967077 CET	55188	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.746129036 CET	53	55188	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.757924080 CET	56487	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:46.883265018 CET	53	56487	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:46.885822058 CET	56487	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:47.012136936 CET	53	56487	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:47.012314081 CET	56487	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:47.136055946 CET	53	56487	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:47.136220932 CET	56487	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:47.258790016 CET	53	56487	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:47.258944035 CET	56487	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:47.388586998 CET	53	56487	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:48.409301996 CET	58041	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:48.533440113 CET	53	58041	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:48.533632040 CET	58041	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:48.656059980 CET	53	58041	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:48.656259060 CET	58041	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:48.778718948 CET	53	58041	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:48.778923988 CET	58041	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:48.906251907 CET	53	58041	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:48.906414986 CET	58041	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.034547091 CET	53	58041	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:49.047324896 CET	61859	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.169898987 CET	53	61859	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:49.170089960 CET	61859	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.294555902 CET	53	61859	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:49.295804977 CET	61859	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.420949936 CET	53	61859	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:49.423836946 CET	61859	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.546571016 CET	53	61859	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:49.546739101 CET	61859	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:49.669610023 CET	53	61859	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:50.714179039 CET	56028	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:50.844264984 CET	53	56028	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:50.845340014 CET	56028	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:50.975009918 CET	53	56028	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:50.975734949 CET	56028	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.107072115 CET	53	56028	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.107289076 CET	56028	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.238219023 CET	53	56028	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.238437891 CET	56028	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.380547047 CET	53	56028	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.398101091 CET	59464	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.538857937 CET	53	59464	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.543389082 CET	59464	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.668603897 CET	53	59464	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.669863939 CET	59464	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.795589924 CET	53	59464	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.797904015 CET	59464	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:51.933440924 CET	53	59464	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:51.934334993 CET	59464	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:52.063272953 CET	53	59464	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.087485075 CET	51714	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.211412907 CET	53	51714	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.211638927 CET	51714	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.345494986 CET	53	51714	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.346096039 CET	51714	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.480201006 CET	53	51714	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.482081890 CET	51714	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.615907907 CET	53	51714	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.616111994 CET	51714	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.744781971 CET	53	51714	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.756048918 CET	57869	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:53.879162073 CET	53	57869	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:53.879534006 CET	57869	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:54.002794981 CET	53	57869	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:54.003848076 CET	57869	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:54.133625031 CET	53	57869	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:54.136171103 CET	57869	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:54.258676052 CET	53	57869	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:54.258908987 CET	57869	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:54.382441044 CET	53	57869	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:55.395365953 CET	60458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:55.518155098 CET	53	60458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:55.519859076 CET	60458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:55.642527103 CET	53	60458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:55.642901897 CET	60458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:55.767190933 CET	53	60458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:55.768558025 CET	60458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:55.891391039 CET	53	60458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:55.891613007 CET	60458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:56.014621019 CET	53	60458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.039586067 CET	58210	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.164544106 CET	53	58210	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.164746046 CET	58210	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.288551092 CET	53	58210	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.288743019 CET	58210	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.413137913 CET	53	58210	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.413399935 CET	58210	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.538497925 CET	53	58210	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.538657904 CET	58210	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.664582968 CET	53	58210	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.674079895 CET	56458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.799865007 CET	53	56458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.800024986 CET	56458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:57.928814888 CET	53	56458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:57.929060936 CET	56458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:58.056209087 CET	53	56458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:58.056392908 CET	56458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:58.179163933 CET	53	56458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:58.179338932 CET	56458	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:58.302778959 CET	53	56458	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.316394091 CET	54091	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:59.445764065 CET	53	54091	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.445976973 CET	54091	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:59.568619013 CET	53	54091	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.568790913 CET	54091	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:59.694811106 CET	53	54091	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.694982052 CET	54091	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:59.818675995 CET	53	54091	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.828522921 CET	50347	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:44:59.951143980 CET	53	50347	8.8.8.8	192.168.2.22
Nov 20, 2024 22:44:59.958719015 CET	50347	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:00.081394911 CET	53	50347	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:00.081566095 CET	50347	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:00.205602884 CET	53	50347	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:00.205763102 CET	50347	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:00.330046892 CET	53	50347	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:00.330384016 CET	50347	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:00.461791039 CET	53	50347	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:01.484838009 CET	51711	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:01.607443094 CET	53	51711	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:01.607654095 CET	51711	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:01.730353117 CET	53	51711	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:01.730542898 CET	51711	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:01.853204012 CET	53	51711	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:01.853384972 CET	51711	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:01.977627039 CET	53	51711	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:01.977804899 CET	51711	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:02.100620031 CET	53	51711	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:02.623975039 CET	51213	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:02.759486914 CET	53	51213	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:02.957192898 CET	51213	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:03.099929094 CET	53	51213	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:03.129492998 CET	51213	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:03.259942055 CET	53	51213	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:03.260433912 CET	51213	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:03.388597012 CET	53	51213	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:03.388900995 CET	51213	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:03.526256084 CET	53	51213	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:04.539930105 CET	62944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:04.663634062 CET	53	62944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:04.665891886 CET	62944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:04.799896955 CET	53	62944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:04.800179005 CET	62944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:04.923935890 CET	53	62944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:04.926100969 CET	62944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.061105013 CET	53	62944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.061381102 CET	62944	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.196122885 CET	53	62944	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.204705000 CET	53717	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.339190960 CET	53	53717	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.339355946 CET	53717	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.462474108 CET	53	53717	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.464634895 CET	53717	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.605736017 CET	53	53717	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.605914116 CET	53717	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.732238054 CET	53	53717	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:05.732441902 CET	53717	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:05.867222071 CET	53	53717	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.053839922 CET	58950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.176774979 CET	53	58950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.177016020 CET	58950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.299504995 CET	53	58950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.299709082 CET	58950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.433656931 CET	53	58950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.433846951 CET	58950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.556802988 CET	53	58950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.556991100 CET	58950	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.679683924 CET	53	58950	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.695112944 CET	51454	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.817584038 CET	53	51454	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.817753077 CET	51454	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:07.953624010 CET	53	51454	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:07.953788996 CET	51454	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:08.076469898 CET	53	51454	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:08.076658964 CET	51454	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:08.200375080 CET	53	51454	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:08.200529099 CET	51454	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:08.331455946 CET	53	51454	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:10.589461088 CET	50897	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:10.712587118 CET	53	50897	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:10.712770939 CET	50897	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:10.838315964 CET	53	50897	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:10.838493109 CET	50897	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:10.962117910 CET	53	50897	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:10.962290049 CET	50897	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.085819960 CET	53	50897	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.086107969 CET	50897	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.209233046 CET	53	50897	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.219770908 CET	51698	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.342340946 CET	53	51698	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.342637062 CET	51698	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.467267990 CET	53	51698	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.467858076 CET	51698	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.590616941 CET	53	51698	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.590787888 CET	51698	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.714055061 CET	53	51698	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:11.714226961 CET	51698	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:11.837676048 CET	53	51698	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:12.874344110 CET	49683	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:12.997339964 CET	53	49683	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:12.997565031 CET	49683	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.121251106 CET	53	49683	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.121471882 CET	49683	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.246927977 CET	53	49683	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.247116089 CET	49683	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.371977091 CET	53	49683	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.373883963 CET	49683	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.497890949 CET	53	49683	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.505451918 CET	59686	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.629019976 CET	53	59686	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.630048037 CET	59686	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.753768921 CET	53	59686	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.758560896 CET	59686	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:13.881236076 CET	53	59686	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:13.890360117 CET	59686	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:14.013149977 CET	53	59686	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:14.014307976 CET	59686	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:14.137351990 CET	53	59686	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.149477959 CET	50304	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.272078037 CET	53	50304	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.274813890 CET	50304	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.397327900 CET	53	50304	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.399866104 CET	50304	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.522411108 CET	53	50304	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.523854017 CET	50304	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.658008099 CET	53	50304	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.658188105 CET	50304	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.780560017 CET	53	50304	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.792429924 CET	54104	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:15.915047884 CET	53	54104	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:15.915863991 CET	54104	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:16.038538933 CET	53	54104	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:16.039890051 CET	54104	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:16.162271023 CET	53	54104	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:16.163863897 CET	54104	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:16.286515951 CET	53	54104	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:16.291696072 CET	54104	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:16.417552948 CET	53	54104	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:17.426740885 CET	65061	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:17.550061941 CET	53	65061	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:17.550472021 CET	65061	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:17.673789024 CET	53	65061	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:17.674796104 CET	65061	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:17.797616005 CET	53	65061	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:17.798223019 CET	65061	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:17.920892000 CET	53	65061	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:17.921869040 CET	65061	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.045931101 CET	53	65061	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:18.055346012 CET	60565	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.177941084 CET	53	60565	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:18.183860064 CET	60565	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.318202019 CET	53	60565	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:18.322040081 CET	60565	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.447195053 CET	53	60565	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:18.447381020 CET	60565	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.570028067 CET	53	60565	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:18.570194006 CET	60565	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:18.693500996 CET	53	60565	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:19.733756065 CET	57354	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:19.857412100 CET	53	57354	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:19.858371973 CET	57354	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:19.980935097 CET	53	57354	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:19.981935024 CET	57354	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.104726076 CET	53	57354	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.105922937 CET	57354	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.229099035 CET	53	57354	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.229300976 CET	57354	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.352229118 CET	53	57354	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.361288071 CET	63768	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.483831882 CET	53	63768	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.484000921 CET	63768	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.606414080 CET	53	63768	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.606558084 CET	63768	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.728948116 CET	53	63768	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:20.729124069 CET	63768	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:20.851521969 CET	53	63768	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:21.871743917 CET	54841	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:21.996212959 CET	53	54841	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:21.996804953 CET	54841	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:22.119257927 CET	53	54841	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:22.127490044 CET	54841	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:22.249844074 CET	53	54841	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:22.250232935 CET	54841	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:22.372970104 CET	53	54841	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:22.373117924 CET	54841	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:22.498006105 CET	53	54841	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:23.515746117 CET	52409	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:23.638358116 CET	53	52409	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:23.638726950 CET	52409	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:23.761142969 CET	53	52409	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:23.762482882 CET	52409	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:23.885114908 CET	53	52409	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:23.887952089 CET	52409	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:24.010612965 CET	53	52409	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:24.014465094 CET	52409	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:24.138200998 CET	53	52409	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.160001040 CET	57077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.282656908 CET	53	57077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.282866001 CET	57077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.405311108 CET	53	57077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.406012058 CET	57077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.529057980 CET	53	57077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.531636000 CET	57077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.656447887 CET	53	57077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.659974098 CET	57077	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.782582045 CET	53	57077	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.792160034 CET	64693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:25.917692900 CET	53	64693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:25.919961929 CET	64693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:26.050820112 CET	53	64693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:26.051923037 CET	64693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:26.174455881 CET	53	64693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:26.175957918 CET	64693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:26.298827887 CET	53	64693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:26.299928904 CET	64693	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:26.426004887 CET	53	64693	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:27.443756104 CET	51020	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:27.572145939 CET	53	51020	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:27.575963974 CET	51020	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:27.698718071 CET	53	51020	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:27.703946114 CET	51020	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:27.826412916 CET	53	51020	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:27.828056097 CET	51020	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:27.950998068 CET	53	51020	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:27.958786964 CET	51020	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:28.081641912 CET	53	51020	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.095722914 CET	55064	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.218525887 CET	53	55064	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.218713999 CET	55064	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.341439009 CET	53	55064	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.343130112 CET	55064	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.465980053 CET	53	55064	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.470148087 CET	55064	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.593890905 CET	53	55064	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.594144106 CET	55064	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.720740080 CET	53	55064	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.730983973 CET	53706	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.853655100 CET	53	53706	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.854896069 CET	53706	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:29.977442026 CET	53	53706	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:29.977940083 CET	53706	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:30.100660086 CET	53	53706	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:30.103893042 CET	53706	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:30.226457119 CET	53	53706	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:30.229924917 CET	53706	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:30.352663040 CET	53	53706	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:31.372692108 CET	65268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:31.495248079 CET	53	65268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:31.495955944 CET	65268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:31.618379116 CET	53	65268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:31.619962931 CET	65268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:31.742407084 CET	53	65268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:31.747699022 CET	65268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:31.869993925 CET	53	65268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:31.871957064 CET	65268	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:31.995028973 CET	53	65268	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:32.011827946 CET	55155	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:32.135937929 CET	53	55155	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:32.138217926 CET	55155	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:32.260597944 CET	53	55155	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:32.263883114 CET	55155	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:32.386348963 CET	53	55155	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:32.386545897 CET	55155	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:32.509006023 CET	53	55155	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:32.509207010 CET	55155	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:32.632206917 CET	53	55155	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:33.650275946 CET	61736	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:33.772728920 CET	53	61736	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:33.773943901 CET	61736	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:33.896398067 CET	53	61736	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:33.899146080 CET	61736	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.021536112 CET	53	61736	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.022671938 CET	61736	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.145365953 CET	53	61736	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.147088051 CET	61736	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.270790100 CET	53	61736	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.279696941 CET	49894	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.402206898 CET	53	49894	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.402420998 CET	49894	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.524761915 CET	53	49894	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.524987936 CET	49894	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.647465944 CET	53	49894	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.647667885 CET	49894	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.770165920 CET	53	49894	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:34.770443916 CET	49894	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:34.892844915 CET	53	49894	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:35.911766052 CET	63195	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:36.034218073 CET	53	63195	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:36.035922050 CET	63195	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:36.158436060 CET	53	63195	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:36.159899950 CET	63195	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:36.282759905 CET	53	63195	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:36.283917904 CET	63195	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:36.408555984 CET	53	63195	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:36.408709049 CET	63195	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:41.435976028 CET	55152	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:41.558509111 CET	53	55152	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:41.558697939 CET	55152	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:41.682077885 CET	53	55152	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:41.682248116 CET	55152	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:41.807238102 CET	53	55152	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:41.813440084 CET	55083	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:41.935904980 CET	53	55083	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:41.936115980 CET	55083	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:42.058497906 CET	53	55083	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:42.154509068 CET	55083	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:42.276977062 CET	53	55083	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:43.284892082 CET	49633	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:43.408405066 CET	53	49633	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:43.410018921 CET	61656	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:43.532402039 CET	53	61656	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:44.546780109 CET	54067	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:44.669850111 CET	53	54067	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:44.671396017 CET	55422	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:44.793765068 CET	53	55422	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:45.794974089 CET	53996	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:45.917561054 CET	53	53996	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:45.921022892 CET	60112	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:46.043620110 CET	53	60112	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:47.058738947 CET	54972	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:47.182219982 CET	53	54972	8.8.8.8	192.168.2.22
Nov 20, 2024 22:45:47.183691025 CET	57107	53	192.168.2.22	8.8.8.8
Nov 20, 2024 22:45:47.306103945 CET	53	57107	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 22:41:52.178081036 CET	192.168.2.22	8.8.8.8	0x541d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:52.877453089 CET	192.168.2.22	8.8.8.8	0xc1fa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:54.264229059 CET	192.168.2.22	8.8.8.8	0x857c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:54.404386997 CET	192.168.2.22	8.8.8.8	0x31d2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:55.695888042 CET	192.168.2.22	8.8.8.8	0xd774	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:55.833795071 CET	192.168.2.22	8.8.8.8	0xdc22	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:56.977067947 CET	192.168.2.22	8.8.8.8	0x6160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:57.329600096 CET	192.168.2.22	8.8.8.8	0xe680	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:58.472569942 CET	192.168.2.22	8.8.8.8	0x6219	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:58.617953062 CET	192.168.2.22	8.8.8.8	0x5c58	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:00.005224943 CET	192.168.2.22	8.8.8.8	0xe61d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:00.392776966 CET	192.168.2.22	8.8.8.8	0x6ea6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:01.529712915 CET	192.168.2.22	8.8.8.8	0x5fe2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:01.828950882 CET	192.168.2.22	8.8.8.8	0x6f26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:02.990683079 CET	192.168.2.22	8.8.8.8	0x5fa7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:03.140675068 CET	192.168.2.22	8.8.8.8	0xa3e2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:04.381591082 CET	192.168.2.22	8.8.8.8	0x35e8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:04.535044909 CET	192.168.2.22	8.8.8.8	0xfb93	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:05.663636923 CET	192.168.2.22	8.8.8.8	0x5094	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:05.799801111 CET	192.168.2.22	8.8.8.8	0x5986	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:06.957926035 CET	192.168.2.22	8.8.8.8	0x415e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:07.095196962 CET	192.168.2.22	8.8.8.8	0x2c65	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:08.237298012 CET	192.168.2.22	8.8.8.8	0xb0c1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:08.365088940 CET	192.168.2.22	8.8.8.8	0x3d69	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:09.500956059 CET	192.168.2.22	8.8.8.8	0xd984	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:09.625911951 CET	192.168.2.22	8.8.8.8	0x7db5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:10.864537001 CET	192.168.2.22	8.8.8.8	0xa225	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:11.351821899 CET	192.168.2.22	8.8.8.8	0x981	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:12.513428926 CET	192.168.2.22	8.8.8.8	0x2bcc	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:12.649547100 CET	192.168.2.22	8.8.8.8	0xe714	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:13.793076038 CET	192.168.2.22	8.8.8.8	0x95ca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:14.105748892 CET	192.168.2.22	8.8.8.8	0xce40	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:15.295449972 CET	192.168.2.22	8.8.8.8	0x7bdc	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:15.420433998 CET	192.168.2.22	8.8.8.8	0x23a1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:16.567660093 CET	192.168.2.22	8.8.8.8	0x4744	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:16.704500914 CET	192.168.2.22	8.8.8.8	0xb800	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:17.866483927 CET	192.168.2.22	8.8.8.8	0xb2ea	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:18.006992102 CET	192.168.2.22	8.8.8.8	0xb449	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:19.158682108 CET	192.168.2.22	8.8.8.8	0xacc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:19.295794964 CET	192.168.2.22	8.8.8.8	0x21a8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:20.493295908 CET	192.168.2.22	8.8.8.8	0x7cf9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:20.710217953 CET	192.168.2.22	8.8.8.8	0x5c41	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:21.861198902 CET	192.168.2.22	8.8.8.8	0xaafc	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:21.992259979 CET	192.168.2.22	8.8.8.8	0x6530	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:23.137077093 CET	192.168.2.22	8.8.8.8	0xddb2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:23.261719942 CET	192.168.2.22	8.8.8.8	0xdab3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:24.405260086 CET	192.168.2.22	8.8.8.8	0xbf5d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:24.600804090 CET	192.168.2.22	8.8.8.8	0xb618	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:25.741007090 CET	192.168.2.22	8.8.8.8	0xff4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:25.879163980 CET	192.168.2.22	8.8.8.8	0xa537	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:27.022233009 CET	192.168.2.22	8.8.8.8	0x54e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:27.159246922 CET	192.168.2.22	8.8.8.8	0xfc88	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:28.312661886 CET	192.168.2.22	8.8.8.8	0x8bea	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:28.438308001 CET	192.168.2.22	8.8.8.8	0x636	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:29.578263044 CET	192.168.2.22	8.8.8.8	0x8721	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:29.707176924 CET	192.168.2.22	8.8.8.8	0x8f9e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:30.841684103 CET	192.168.2.22	8.8.8.8	0x9f14	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:31.111491919 CET	192.168.2.22	8.8.8.8	0xc607	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:32.261615038 CET	192.168.2.22	8.8.8.8	0x4e63	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:32.639065027 CET	192.168.2.22	8.8.8.8	0x3b7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:33.777429104 CET	192.168.2.22	8.8.8.8	0x7126	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:33.918979883 CET	192.168.2.22	8.8.8.8	0x14bb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:35.555509090 CET	192.168.2.22	8.8.8.8	0x71a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:35.809771061 CET	192.168.2.22	8.8.8.8	0x93e7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:36.956923962 CET	192.168.2.22	8.8.8.8	0xf68b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:37.093483925 CET	192.168.2.22	8.8.8.8	0xce27	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:38.212934017 CET	192.168.2.22	8.8.8.8	0x244	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:38.340447903 CET	192.168.2.22	8.8.8.8	0x21b5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:39.406939983 CET	192.168.2.22	8.8.8.8	0xe497	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:39.531995058 CET	192.168.2.22	8.8.8.8	0x3c4f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:40.560913086 CET	192.168.2.22	8.8.8.8	0xef73	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:40.687902927 CET	192.168.2.22	8.8.8.8	0xae6e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:41.688559055 CET	192.168.2.22	8.8.8.8	0x10d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:41.814784050 CET	192.168.2.22	8.8.8.8	0xfaa7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:42.890582085 CET	192.168.2.22	8.8.8.8	0x2cbb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:43.054187059 CET	192.168.2.22	8.8.8.8	0xd2e0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:43.993132114 CET	192.168.2.22	8.8.8.8	0x687c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:44.129650116 CET	192.168.2.22	8.8.8.8	0x8006	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:45.079973936 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:45.216595888 CET	192.168.2.22	8.8.8.8	0x8b16	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:46.145133018 CET	192.168.2.22	8.8.8.8	0x16c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:46.302201986 CET	192.168.2.22	8.8.8.8	0xbc6f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:47.190989017 CET	192.168.2.22	8.8.8.8	0xf087	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:47.327231884 CET	192.168.2.22	8.8.8.8	0x4893	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:48.157860041 CET	192.168.2.22	8.8.8.8	0x2c22	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:48.298299074 CET	192.168.2.22	8.8.8.8	0xb0b7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.128974915 CET	192.168.2.22	8.8.8.8	0xf8cb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.263531923 CET	192.168.2.22	8.8.8.8	0xf8cb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.400122881 CET	192.168.2.22	8.8.8.8	0x13d1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.201313019 CET	192.168.2.22	8.8.8.8	0xb0f3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.339848995 CET	192.168.2.22	8.8.8.8	0x4211	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.463481903 CET	192.168.2.22	8.8.8.8	0x4211	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.234951019 CET	192.168.2.22	8.8.8.8	0xffad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.369558096 CET	192.168.2.22	8.8.8.8	0xffad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.506786108 CET	192.168.2.22	8.8.8.8	0x2516	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.246423006 CET	192.168.2.22	8.8.8.8	0x8a8f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.387197971 CET	192.168.2.22	8.8.8.8	0xeb7c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.521939993 CET	192.168.2.22	8.8.8.8	0xeb7c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.247814894 CET	192.168.2.22	8.8.8.8	0x1cfb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.371134043 CET	192.168.2.22	8.8.8.8	0x1cfb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.507003069 CET	192.168.2.22	8.8.8.8	0x1cfb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.643922091 CET	192.168.2.22	8.8.8.8	0x4ed3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.767092943 CET	192.168.2.22	8.8.8.8	0x4ed3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.889765978 CET	192.168.2.22	8.8.8.8	0x4ed3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.621337891 CET	192.168.2.22	8.8.8.8	0x705c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.756577015 CET	192.168.2.22	8.8.8.8	0x705c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.879750013 CET	192.168.2.22	8.8.8.8	0x705c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.002918959 CET	192.168.2.22	8.8.8.8	0x705c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.137242079 CET	192.168.2.22	8.8.8.8	0x705c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.839569092 CET	192.168.2.22	8.8.8.8	0x136	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.974441051 CET	192.168.2.22	8.8.8.8	0x136	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.109126091 CET	192.168.2.22	8.8.8.8	0x136	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.248874903 CET	192.168.2.22	8.8.8.8	0x136	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.371798992 CET	192.168.2.22	8.8.8.8	0x136	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.724948883 CET	192.168.2.22	8.8.8.8	0xda1d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.854937077 CET	192.168.2.22	8.8.8.8	0xda1d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.981636047 CET	192.168.2.22	8.8.8.8	0xda1d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:57.104664087 CET	192.168.2.22	8.8.8.8	0xda1d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:57.239219904 CET	192.168.2.22	8.8.8.8	0xda1d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.018363953 CET	192.168.2.22	8.8.8.8	0xe028	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.153340101 CET	192.168.2.22	8.8.8.8	0xe028	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.287604094 CET	192.168.2.22	8.8.8.8	0xe028	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.421988964 CET	192.168.2.22	8.8.8.8	0xe028	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.544776917 CET	192.168.2.22	8.8.8.8	0xe028	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.807095051 CET	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.942038059 CET	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.080085039 CET	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.203516006 CET	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.337701082 CET	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.108731031 CET	192.168.2.22	8.8.8.8	0x290a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.232745886 CET	192.168.2.22	8.8.8.8	0x290a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.356336117 CET	192.168.2.22	8.8.8.8	0x290a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.627207994 CET	192.168.2.22	8.8.8.8	0x290a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.777544022 CET	192.168.2.22	8.8.8.8	0x290a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.314477921 CET	192.168.2.22	8.8.8.8	0x9430	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.457221985 CET	192.168.2.22	8.8.8.8	0x9430	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.595227003 CET	192.168.2.22	8.8.8.8	0x9430	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.736116886 CET	192.168.2.22	8.8.8.8	0x9430	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.871045113 CET	192.168.2.22	8.8.8.8	0x9430	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.012136936 CET	192.168.2.22	8.8.8.8	0x26ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.147504091 CET	192.168.2.22	8.8.8.8	0x26ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.270172119 CET	192.168.2.22	8.8.8.8	0x26ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.392909050 CET	192.168.2.22	8.8.8.8	0x26ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.519504070 CET	192.168.2.22	8.8.8.8	0x26ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.663053989 CET	192.168.2.22	8.8.8.8	0xbd06	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.785742044 CET	192.168.2.22	8.8.8.8	0xbd06	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.919832945 CET	192.168.2.22	8.8.8.8	0xbd06	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:06.054613113 CET	192.168.2.22	8.8.8.8	0xbd06	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:06.188560963 CET	192.168.2.22	8.8.8.8	0xbd06	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.543968916 CET	192.168.2.22	8.8.8.8	0xcd74	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.678258896 CET	192.168.2.22	8.8.8.8	0xcd74	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.805695057 CET	192.168.2.22	8.8.8.8	0xcd74	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.940043926 CET	192.168.2.22	8.8.8.8	0xcd74	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.063170910 CET	192.168.2.22	8.8.8.8	0xcd74	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.207232952 CET	192.168.2.22	8.8.8.8	0x3ba7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.346889019 CET	192.168.2.22	8.8.8.8	0x3ba7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.471538067 CET	192.168.2.22	8.8.8.8	0x3ba7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.594271898 CET	192.168.2.22	8.8.8.8	0x3ba7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.728594065 CET	192.168.2.22	8.8.8.8	0x3ba7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.242084026 CET	192.168.2.22	8.8.8.8	0xab8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.365214109 CET	192.168.2.22	8.8.8.8	0xab8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.499047995 CET	192.168.2.22	8.8.8.8	0xab8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.622147083 CET	192.168.2.22	8.8.8.8	0xab8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.756352901 CET	192.168.2.22	8.8.8.8	0xab8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.889925957 CET	192.168.2.22	8.8.8.8	0x44e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.024179935 CET	192.168.2.22	8.8.8.8	0x44e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.151612043 CET	192.168.2.22	8.8.8.8	0x44e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.274363041 CET	192.168.2.22	8.8.8.8	0x44e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.410607100 CET	192.168.2.22	8.8.8.8	0x44e1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.625560999 CET	192.168.2.22	8.8.8.8	0xf146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.749381065 CET	192.168.2.22	8.8.8.8	0xf146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.871912003 CET	192.168.2.22	8.8.8.8	0xf146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.994770050 CET	192.168.2.22	8.8.8.8	0xf146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.130337000 CET	192.168.2.22	8.8.8.8	0xf146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.595616102 CET	192.168.2.22	8.8.8.8	0x5f96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.735516071 CET	192.168.2.22	8.8.8.8	0x5f96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.863482952 CET	192.168.2.22	8.8.8.8	0x5f96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.997616053 CET	192.168.2.22	8.8.8.8	0x5f96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:15.120296955 CET	192.168.2.22	8.8.8.8	0x5f96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.259721994 CET	192.168.2.22	8.8.8.8	0x6dcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.389806032 CET	192.168.2.22	8.8.8.8	0x6dcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.513123035 CET	192.168.2.22	8.8.8.8	0x6dcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.648363113 CET	192.168.2.22	8.8.8.8	0x6dcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.770972967 CET	192.168.2.22	8.8.8.8	0x6dcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:17.910284042 CET	192.168.2.22	8.8.8.8	0x5d04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.045274973 CET	192.168.2.22	8.8.8.8	0x5d04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.173948050 CET	192.168.2.22	8.8.8.8	0x5d04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.297034979 CET	192.168.2.22	8.8.8.8	0x5d04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.432872057 CET	192.168.2.22	8.8.8.8	0x5d04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.565253019 CET	192.168.2.22	8.8.8.8	0xb90b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.699701071 CET	192.168.2.22	8.8.8.8	0xb90b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.822510004 CET	192.168.2.22	8.8.8.8	0xb90b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.957431078 CET	192.168.2.22	8.8.8.8	0xb90b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:19.081163883 CET	192.168.2.22	8.8.8.8	0xb90b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.221957922 CET	192.168.2.22	8.8.8.8	0x66af	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.346432924 CET	192.168.2.22	8.8.8.8	0x66af	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.481755972 CET	192.168.2.22	8.8.8.8	0x66af	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.607671976 CET	192.168.2.22	8.8.8.8	0x66af	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.735658884 CET	192.168.2.22	8.8.8.8	0x66af	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.872279882 CET	192.168.2.22	8.8.8.8	0xc66c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.006738901 CET	192.168.2.22	8.8.8.8	0xc66c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.129731894 CET	192.168.2.22	8.8.8.8	0xc66c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.253062010 CET	192.168.2.22	8.8.8.8	0xc66c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.388082981 CET	192.168.2.22	8.8.8.8	0xc66c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.531056881 CET	192.168.2.22	8.8.8.8	0xabd3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.654422998 CET	192.168.2.22	8.8.8.8	0xabd3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.778053045 CET	192.168.2.22	8.8.8.8	0xabd3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.900840998 CET	192.168.2.22	8.8.8.8	0xabd3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:23.023947954 CET	192.168.2.22	8.8.8.8	0xabd3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.169333935 CET	192.168.2.22	8.8.8.8	0x346f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.292128086 CET	192.168.2.22	8.8.8.8	0x346f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.427088022 CET	192.168.2.22	8.8.8.8	0x346f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.561355114 CET	192.168.2.22	8.8.8.8	0x346f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.683900118 CET	192.168.2.22	8.8.8.8	0x346f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.825582027 CET	192.168.2.22	8.8.8.8	0x20c2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.966341019 CET	192.168.2.22	8.8.8.8	0x20c2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.089076996 CET	192.168.2.22	8.8.8.8	0x20c2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.211643934 CET	192.168.2.22	8.8.8.8	0x20c2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.334248066 CET	192.168.2.22	8.8.8.8	0x20c2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.482256889 CET	192.168.2.22	8.8.8.8	0xbb78	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.610050917 CET	192.168.2.22	8.8.8.8	0xbb78	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.745857000 CET	192.168.2.22	8.8.8.8	0xbb78	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.882097960 CET	192.168.2.22	8.8.8.8	0xbb78	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.008996964 CET	192.168.2.22	8.8.8.8	0xbb78	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.137888908 CET	192.168.2.22	8.8.8.8	0x48a4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.260469913 CET	192.168.2.22	8.8.8.8	0x48a4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.384191990 CET	192.168.2.22	8.8.8.8	0x48a4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.506701946 CET	192.168.2.22	8.8.8.8	0x48a4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:28.646064997 CET	192.168.2.22	8.8.8.8	0x6d6b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:28.780203104 CET	192.168.2.22	8.8.8.8	0x6d6b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:28.903012037 CET	192.168.2.22	8.8.8.8	0x6d6b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:29.025681973 CET	192.168.2.22	8.8.8.8	0x6d6b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:29.150170088 CET	192.168.2.22	8.8.8.8	0x6d6b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.280647039 CET	192.168.2.22	8.8.8.8	0xc78c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.420833111 CET	192.168.2.22	8.8.8.8	0xc78c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.546801090 CET	192.168.2.22	8.8.8.8	0xc78c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.669404984 CET	192.168.2.22	8.8.8.8	0xc78c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.792144060 CET	192.168.2.22	8.8.8.8	0xc78c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.932365894 CET	192.168.2.22	8.8.8.8	0xb996	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.055270910 CET	192.168.2.22	8.8.8.8	0xb996	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.178003073 CET	192.168.2.22	8.8.8.8	0xb996	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.312149048 CET	192.168.2.22	8.8.8.8	0xb996	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.446024895 CET	192.168.2.22	8.8.8.8	0xb996	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.608330965 CET	192.168.2.22	8.8.8.8	0x7b89	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.731682062 CET	192.168.2.22	8.8.8.8	0x7b89	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.855667114 CET	192.168.2.22	8.8.8.8	0x7b89	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.978514910 CET	192.168.2.22	8.8.8.8	0x7b89	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.102035999 CET	192.168.2.22	8.8.8.8	0x7b89	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.245883942 CET	192.168.2.22	8.8.8.8	0x9e8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.368700981 CET	192.168.2.22	8.8.8.8	0x9e8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.492316961 CET	192.168.2.22	8.8.8.8	0x9e8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.627875090 CET	192.168.2.22	8.8.8.8	0x9e8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.752496004 CET	192.168.2.22	8.8.8.8	0x9e8a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:34.887566090 CET	192.168.2.22	8.8.8.8	0xc5d9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.022159100 CET	192.168.2.22	8.8.8.8	0xc5d9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.144974947 CET	192.168.2.22	8.8.8.8	0xc5d9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.279059887 CET	192.168.2.22	8.8.8.8	0xc5d9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.414786100 CET	192.168.2.22	8.8.8.8	0xc5d9	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.545502901 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.668457985 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.791148901 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.925611973 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:36.060499907 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.195960999 CET	192.168.2.22	8.8.8.8	0xab8d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.319506884 CET	192.168.2.22	8.8.8.8	0xab8d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.442449093 CET	192.168.2.22	8.8.8.8	0xab8d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.565136909 CET	192.168.2.22	8.8.8.8	0xab8d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.687767982 CET	192.168.2.22	8.8.8.8	0xab8d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.815332890 CET	192.168.2.22	8.8.8.8	0xa259	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.938215971 CET	192.168.2.22	8.8.8.8	0xa259	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.060836077 CET	192.168.2.22	8.8.8.8	0xa259	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.184243917 CET	192.168.2.22	8.8.8.8	0xa259	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.307080984 CET	192.168.2.22	8.8.8.8	0xa259	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.478595972 CET	192.168.2.22	8.8.8.8	0x49f0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.604631901 CET	192.168.2.22	8.8.8.8	0x49f0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.739245892 CET	192.168.2.22	8.8.8.8	0x49f0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.862174034 CET	192.168.2.22	8.8.8.8	0x49f0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.985402107 CET	192.168.2.22	8.8.8.8	0x49f0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.122827053 CET	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.248351097 CET	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.370959044 CET	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.494081020 CET	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.619532108 CET	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.759449005 CET	192.168.2.22	8.8.8.8	0x4252	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.893632889 CET	192.168.2.22	8.8.8.8	0x4252	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.028276920 CET	192.168.2.22	8.8.8.8	0x4252	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.159571886 CET	192.168.2.22	8.8.8.8	0x4252	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.303679943 CET	192.168.2.22	8.8.8.8	0x4252	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.435604095 CET	192.168.2.22	8.8.8.8	0xe03f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.558629990 CET	192.168.2.22	8.8.8.8	0xe03f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.682840109 CET	192.168.2.22	8.8.8.8	0xe03f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.806402922 CET	192.168.2.22	8.8.8.8	0xe03f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.929265022 CET	192.168.2.22	8.8.8.8	0xe03f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:44.060718060 CET	192.168.2.22	8.8.8.8	0x2113	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.215846062 CET	192.168.2.22	8.8.8.8	0x8af4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.338937998 CET	192.168.2.22	8.8.8.8	0x8af4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.463455915 CET	192.168.2.22	8.8.8.8	0x8af4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.595027924 CET	192.168.2.22	8.8.8.8	0x8af4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.725033998 CET	192.168.2.22	8.8.8.8	0x8af4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:46.855588913 CET	192.168.2.22	8.8.8.8	0x92ec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:46.997787952 CET	192.168.2.22	8.8.8.8	0x92ec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.132141113 CET	192.168.2.22	8.8.8.8	0x92ec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.270237923 CET	192.168.2.22	8.8.8.8	0x92ec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.395850897 CET	192.168.2.22	8.8.8.8	0x92ec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.536408901 CET	192.168.2.22	8.8.8.8	0x3f05	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.679987907 CET	192.168.2.22	8.8.8.8	0x3f05	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.818293095 CET	192.168.2.22	8.8.8.8	0x3f05	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.944180012 CET	192.168.2.22	8.8.8.8	0x3f05	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.082565069 CET	192.168.2.22	8.8.8.8	0x3f05	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.619656086 CET	192.168.2.22	8.8.8.8	0xefc3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.789527893 CET	192.168.2.22	8.8.8.8	0xefc3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.942755938 CET	192.168.2.22	8.8.8.8	0xefc3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:50.098722935 CET	192.168.2.22	8.8.8.8	0xefc3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:50.233591080 CET	192.168.2.22	8.8.8.8	0xefc3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.394714117 CET	192.168.2.22	8.8.8.8	0xe28d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.519958973 CET	192.168.2.22	8.8.8.8	0xe28d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.643131971 CET	192.168.2.22	8.8.8.8	0xe28d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.774300098 CET	192.168.2.22	8.8.8.8	0xe28d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.898921967 CET	192.168.2.22	8.8.8.8	0xe28d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.029953957 CET	192.168.2.22	8.8.8.8	0x342e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.159743071 CET	192.168.2.22	8.8.8.8	0x342e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.283070087 CET	192.168.2.22	8.8.8.8	0x342e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.405934095 CET	192.168.2.22	8.8.8.8	0x342e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.531713963 CET	192.168.2.22	8.8.8.8	0x342e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:53.827788115 CET	192.168.2.22	8.8.8.8	0x8383	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:53.964926004 CET	192.168.2.22	8.8.8.8	0x8383	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.103713036 CET	192.168.2.22	8.8.8.8	0x8383	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.226705074 CET	192.168.2.22	8.8.8.8	0x8383	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.351814985 CET	192.168.2.22	8.8.8.8	0x8383	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.492530107 CET	192.168.2.22	8.8.8.8	0x665f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.615362883 CET	192.168.2.22	8.8.8.8	0x665f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.738064051 CET	192.168.2.22	8.8.8.8	0x665f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.872292995 CET	192.168.2.22	8.8.8.8	0x665f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.997066975 CET	192.168.2.22	8.8.8.8	0x665f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.149772882 CET	192.168.2.22	8.8.8.8	0x5160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.275778055 CET	192.168.2.22	8.8.8.8	0x5160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.411724091 CET	192.168.2.22	8.8.8.8	0x5160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.547841072 CET	192.168.2.22	8.8.8.8	0x5160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.676057100 CET	192.168.2.22	8.8.8.8	0x5160	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.814810991 CET	192.168.2.22	8.8.8.8	0x7c4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.953620911 CET	192.168.2.22	8.8.8.8	0x7c4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.079387903 CET	192.168.2.22	8.8.8.8	0x7c4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.202267885 CET	192.168.2.22	8.8.8.8	0x7c4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.326184034 CET	192.168.2.22	8.8.8.8	0x7c4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.475044012 CET	192.168.2.22	8.8.8.8	0xf8d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.597810030 CET	192.168.2.22	8.8.8.8	0xf8d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.731801987 CET	192.168.2.22	8.8.8.8	0xf8d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.855751038 CET	192.168.2.22	8.8.8.8	0xf8d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.979818106 CET	192.168.2.22	8.8.8.8	0xf8d3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.116810083 CET	192.168.2.22	8.8.8.8	0x7ce0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.239728928 CET	192.168.2.22	8.8.8.8	0x7ce0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.368987083 CET	192.168.2.22	8.8.8.8	0x7ce0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.491592884 CET	192.168.2.22	8.8.8.8	0x7ce0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.622474909 CET	192.168.2.22	8.8.8.8	0x7ce0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:00.764117956 CET	192.168.2.22	8.8.8.8	0xae3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:00.888775110 CET	192.168.2.22	8.8.8.8	0xae3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.011672974 CET	192.168.2.22	8.8.8.8	0xae3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.134578943 CET	192.168.2.22	8.8.8.8	0xae3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.257286072 CET	192.168.2.22	8.8.8.8	0xae3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.390852928 CET	192.168.2.22	8.8.8.8	0x2dd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.517911911 CET	192.168.2.22	8.8.8.8	0x2dd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.642142057 CET	192.168.2.22	8.8.8.8	0x2dd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.776952982 CET	192.168.2.22	8.8.8.8	0x2dd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.912003040 CET	192.168.2.22	8.8.8.8	0x2dd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.403675079 CET	192.168.2.22	8.8.8.8	0xc599	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.529376984 CET	192.168.2.22	8.8.8.8	0xc599	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.654721022 CET	192.168.2.22	8.8.8.8	0xc599	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.782166958 CET	192.168.2.22	8.8.8.8	0xc599	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.905885935 CET	192.168.2.22	8.8.8.8	0xc599	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.040992022 CET	192.168.2.22	8.8.8.8	0x6a30	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.164057970 CET	192.168.2.22	8.8.8.8	0x6a30	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.300533056 CET	192.168.2.22	8.8.8.8	0x6a30	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.423429966 CET	192.168.2.22	8.8.8.8	0x6a30	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.546495914 CET	192.168.2.22	8.8.8.8	0x6a30	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:06.866760015 CET	192.168.2.22	8.8.8.8	0x6ea1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.002222061 CET	192.168.2.22	8.8.8.8	0x6ea1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.125026941 CET	192.168.2.22	8.8.8.8	0x6ea1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.247826099 CET	192.168.2.22	8.8.8.8	0x6ea1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.375583887 CET	192.168.2.22	8.8.8.8	0x6ea1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.523107052 CET	192.168.2.22	8.8.8.8	0x9531	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.658483028 CET	192.168.2.22	8.8.8.8	0x9531	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.781433105 CET	192.168.2.22	8.8.8.8	0x9531	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.905966997 CET	192.168.2.22	8.8.8.8	0x9531	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.029133081 CET	192.168.2.22	8.8.8.8	0x9531	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.189661980 CET	192.168.2.22	8.8.8.8	0xcc96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.312443018 CET	192.168.2.22	8.8.8.8	0xcc96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.465585947 CET	192.168.2.22	8.8.8.8	0xcc96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.590342045 CET	192.168.2.22	8.8.8.8	0xcc96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.713236094 CET	192.168.2.22	8.8.8.8	0xcc96	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:10.889831066 CET	192.168.2.22	8.8.8.8	0xf614	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.014687061 CET	192.168.2.22	8.8.8.8	0xf614	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.149755001 CET	192.168.2.22	8.8.8.8	0xf614	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.273473024 CET	192.168.2.22	8.8.8.8	0xf614	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.408061028 CET	192.168.2.22	8.8.8.8	0xf614	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.542824030 CET	192.168.2.22	8.8.8.8	0x587b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.665693998 CET	192.168.2.22	8.8.8.8	0x587b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.788584948 CET	192.168.2.22	8.8.8.8	0x587b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.918217897 CET	192.168.2.22	8.8.8.8	0x587b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:12.041860104 CET	192.168.2.22	8.8.8.8	0x587b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.183593988 CET	192.168.2.22	8.8.8.8	0x99ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.311965942 CET	192.168.2.22	8.8.8.8	0x99ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.443839073 CET	192.168.2.22	8.8.8.8	0x99ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.575830936 CET	192.168.2.22	8.8.8.8	0x99ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.707338095 CET	192.168.2.22	8.8.8.8	0x99ee	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:14.856596947 CET	192.168.2.22	8.8.8.8	0xabc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:14.987962008 CET	192.168.2.22	8.8.8.8	0xabc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.114727974 CET	192.168.2.22	8.8.8.8	0xabc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.239554882 CET	192.168.2.22	8.8.8.8	0xabc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.362791061 CET	192.168.2.22	8.8.8.8	0xabc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.502481937 CET	192.168.2.22	8.8.8.8	0x9b26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.645324945 CET	192.168.2.22	8.8.8.8	0x9b26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.774894953 CET	192.168.2.22	8.8.8.8	0x9b26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.903855085 CET	192.168.2.22	8.8.8.8	0x9b26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:16.035847902 CET	192.168.2.22	8.8.8.8	0x9b26	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:17.612345934 CET	192.168.2.22	8.8.8.8	0xd857	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:17.740286112 CET	192.168.2.22	8.8.8.8	0xd857	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:17.900887966 CET	192.168.2.22	8.8.8.8	0xd857	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.093208075 CET	192.168.2.22	8.8.8.8	0xd857	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.216161966 CET	192.168.2.22	8.8.8.8	0xd857	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.372128010 CET	192.168.2.22	8.8.8.8	0x52e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.495100975 CET	192.168.2.22	8.8.8.8	0x52e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.618091106 CET	192.168.2.22	8.8.8.8	0x52e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.741580963 CET	192.168.2.22	8.8.8.8	0x52e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.864559889 CET	192.168.2.22	8.8.8.8	0x52e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.001494884 CET	192.168.2.22	8.8.8.8	0x6ef1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.125878096 CET	192.168.2.22	8.8.8.8	0x6ef1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.251835108 CET	192.168.2.22	8.8.8.8	0x6ef1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.375190973 CET	192.168.2.22	8.8.8.8	0x6ef1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.512850046 CET	192.168.2.22	8.8.8.8	0x6ef1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.117292881 CET	192.168.2.22	8.8.8.8	0xac3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.240185976 CET	192.168.2.22	8.8.8.8	0xac3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.363250017 CET	192.168.2.22	8.8.8.8	0xac3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.486479998 CET	192.168.2.22	8.8.8.8	0xac3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.610527039 CET	192.168.2.22	8.8.8.8	0xac3b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:22.748413086 CET	192.168.2.22	8.8.8.8	0x758e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:22.871386051 CET	192.168.2.22	8.8.8.8	0x758e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:22.994056940 CET	192.168.2.22	8.8.8.8	0x758e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.120084047 CET	192.168.2.22	8.8.8.8	0x758e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.247848988 CET	192.168.2.22	8.8.8.8	0x758e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.380634069 CET	192.168.2.22	8.8.8.8	0x6a04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.503938913 CET	192.168.2.22	8.8.8.8	0x6a04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.627871990 CET	192.168.2.22	8.8.8.8	0x6a04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.750891924 CET	192.168.2.22	8.8.8.8	0x6a04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.873907089 CET	192.168.2.22	8.8.8.8	0x6a04	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.014368057 CET	192.168.2.22	8.8.8.8	0x65d5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.137654066 CET	192.168.2.22	8.8.8.8	0x65d5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.272618055 CET	192.168.2.22	8.8.8.8	0x65d5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.397660971 CET	192.168.2.22	8.8.8.8	0x65d5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.520303011 CET	192.168.2.22	8.8.8.8	0x65d5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.656306982 CET	192.168.2.22	8.8.8.8	0x207c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.779247046 CET	192.168.2.22	8.8.8.8	0x207c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.902868032 CET	192.168.2.22	8.8.8.8	0x207c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:26.025809050 CET	192.168.2.22	8.8.8.8	0x207c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:26.148830891 CET	192.168.2.22	8.8.8.8	0x207c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.285923958 CET	192.168.2.22	8.8.8.8	0xa64d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.415860891 CET	192.168.2.22	8.8.8.8	0xa64d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.547797918 CET	192.168.2.22	8.8.8.8	0xa64d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.675796032 CET	192.168.2.22	8.8.8.8	0xa64d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.798605919 CET	192.168.2.22	8.8.8.8	0xa64d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.931160927 CET	192.168.2.22	8.8.8.8	0xd1f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.129537106 CET	192.168.2.22	8.8.8.8	0xd1f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.256927967 CET	192.168.2.22	8.8.8.8	0xd1f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.389214993 CET	192.168.2.22	8.8.8.8	0xd1f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.515813112 CET	192.168.2.22	8.8.8.8	0xd1f5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:29.657263994 CET	192.168.2.22	8.8.8.8	0x767	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:29.786073923 CET	192.168.2.22	8.8.8.8	0x767	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:29.916136980 CET	192.168.2.22	8.8.8.8	0x767	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.039127111 CET	192.168.2.22	8.8.8.8	0x767	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.173183918 CET	192.168.2.22	8.8.8.8	0x767	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.305824041 CET	192.168.2.22	8.8.8.8	0x7a4a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.428847075 CET	192.168.2.22	8.8.8.8	0x7a4a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.551687956 CET	192.168.2.22	8.8.8.8	0x7a4a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.674556971 CET	192.168.2.22	8.8.8.8	0x7a4a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.800564051 CET	192.168.2.22	8.8.8.8	0x7a4a	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:31.933330059 CET	192.168.2.22	8.8.8.8	0x9cec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.056288004 CET	192.168.2.22	8.8.8.8	0x9cec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.179048061 CET	192.168.2.22	8.8.8.8	0x9cec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.315897942 CET	192.168.2.22	8.8.8.8	0x9cec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.443922997 CET	192.168.2.22	8.8.8.8	0x9cec	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.575983047 CET	192.168.2.22	8.8.8.8	0x5f29	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.699886084 CET	192.168.2.22	8.8.8.8	0x5f29	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.827836990 CET	192.168.2.22	8.8.8.8	0x5f29	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.968111992 CET	192.168.2.22	8.8.8.8	0x5f29	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:33.092612028 CET	192.168.2.22	8.8.8.8	0x5f29	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.234373093 CET	192.168.2.22	8.8.8.8	0x40d4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.370945930 CET	192.168.2.22	8.8.8.8	0x40d4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.495325089 CET	192.168.2.22	8.8.8.8	0x40d4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.618062019 CET	192.168.2.22	8.8.8.8	0x40d4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.742396116 CET	192.168.2.22	8.8.8.8	0x40d4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:35.898603916 CET	192.168.2.22	8.8.8.8	0x5104	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.026633024 CET	192.168.2.22	8.8.8.8	0x5104	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.155862093 CET	192.168.2.22	8.8.8.8	0x5104	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.284112930 CET	192.168.2.22	8.8.8.8	0x5104	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.428117037 CET	192.168.2.22	8.8.8.8	0x5104	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.567173004 CET	192.168.2.22	8.8.8.8	0xfcbd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.699887991 CET	192.168.2.22	8.8.8.8	0xfcbd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.826081991 CET	192.168.2.22	8.8.8.8	0xfcbd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.955776930 CET	192.168.2.22	8.8.8.8	0xfcbd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.087807894 CET	192.168.2.22	8.8.8.8	0xfcbd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.227783918 CET	192.168.2.22	8.8.8.8	0xe792	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.356106043 CET	192.168.2.22	8.8.8.8	0xe792	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.482691050 CET	192.168.2.22	8.8.8.8	0xe792	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.605516911 CET	192.168.2.22	8.8.8.8	0xe792	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.728790045 CET	192.168.2.22	8.8.8.8	0xe792	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:39.857471943 CET	192.168.2.22	8.8.8.8	0x5c20	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:39.982702971 CET	192.168.2.22	8.8.8.8	0x5c20	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.105894089 CET	192.168.2.22	8.8.8.8	0x5c20	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.229937077 CET	192.168.2.22	8.8.8.8	0x5c20	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.353914976 CET	192.168.2.22	8.8.8.8	0x5c20	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.509021997 CET	192.168.2.22	8.8.8.8	0x4b4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.637342930 CET	192.168.2.22	8.8.8.8	0x4b4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.768879890 CET	192.168.2.22	8.8.8.8	0x4b4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.892949104 CET	192.168.2.22	8.8.8.8	0x4b4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.017401934 CET	192.168.2.22	8.8.8.8	0x4b4e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.182602882 CET	192.168.2.22	8.8.8.8	0xe146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.312939882 CET	192.168.2.22	8.8.8.8	0xe146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.437978029 CET	192.168.2.22	8.8.8.8	0xe146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.577995062 CET	192.168.2.22	8.8.8.8	0xe146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.703809977 CET	192.168.2.22	8.8.8.8	0xe146	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:43.850754976 CET	192.168.2.22	8.8.8.8	0x3d5c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:43.973496914 CET	192.168.2.22	8.8.8.8	0x3d5c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.096774101 CET	192.168.2.22	8.8.8.8	0x3d5c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.219955921 CET	192.168.2.22	8.8.8.8	0x3d5c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.342617989 CET	192.168.2.22	8.8.8.8	0x3d5c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.487968922 CET	192.168.2.22	8.8.8.8	0x1327	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.610951900 CET	192.168.2.22	8.8.8.8	0x1327	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.733576059 CET	192.168.2.22	8.8.8.8	0x1327	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.857284069 CET	192.168.2.22	8.8.8.8	0x1327	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.980389118 CET	192.168.2.22	8.8.8.8	0x1327	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.116460085 CET	192.168.2.22	8.8.8.8	0x534	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.242058039 CET	192.168.2.22	8.8.8.8	0x534	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.365833044 CET	192.168.2.22	8.8.8.8	0x534	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.497886896 CET	192.168.2.22	8.8.8.8	0x534	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.621967077 CET	192.168.2.22	8.8.8.8	0x534	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.757924080 CET	192.168.2.22	8.8.8.8	0xba4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.885822058 CET	192.168.2.22	8.8.8.8	0xba4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.012314081 CET	192.168.2.22	8.8.8.8	0xba4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.136220932 CET	192.168.2.22	8.8.8.8	0xba4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.258944035 CET	192.168.2.22	8.8.8.8	0xba4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.409301996 CET	192.168.2.22	8.8.8.8	0xe766	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.533632040 CET	192.168.2.22	8.8.8.8	0xe766	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.656259060 CET	192.168.2.22	8.8.8.8	0xe766	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.778923988 CET	192.168.2.22	8.8.8.8	0xe766	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.906414986 CET	192.168.2.22	8.8.8.8	0xe766	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.047324896 CET	192.168.2.22	8.8.8.8	0x874b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.170089960 CET	192.168.2.22	8.8.8.8	0x874b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.295804977 CET	192.168.2.22	8.8.8.8	0x874b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.423836946 CET	192.168.2.22	8.8.8.8	0x874b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.546739101 CET	192.168.2.22	8.8.8.8	0x874b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:50.714179039 CET	192.168.2.22	8.8.8.8	0x6e24	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:50.845340014 CET	192.168.2.22	8.8.8.8	0x6e24	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:50.975734949 CET	192.168.2.22	8.8.8.8	0x6e24	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.107289076 CET	192.168.2.22	8.8.8.8	0x6e24	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.238437891 CET	192.168.2.22	8.8.8.8	0x6e24	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.398101091 CET	192.168.2.22	8.8.8.8	0x7332	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.543389082 CET	192.168.2.22	8.8.8.8	0x7332	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.669863939 CET	192.168.2.22	8.8.8.8	0x7332	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.797904015 CET	192.168.2.22	8.8.8.8	0x7332	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.934334993 CET	192.168.2.22	8.8.8.8	0x7332	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.087485075 CET	192.168.2.22	8.8.8.8	0x1fcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.211638927 CET	192.168.2.22	8.8.8.8	0x1fcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.346096039 CET	192.168.2.22	8.8.8.8	0x1fcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.482081890 CET	192.168.2.22	8.8.8.8	0x1fcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.616111994 CET	192.168.2.22	8.8.8.8	0x1fcf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.756048918 CET	192.168.2.22	8.8.8.8	0x16a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.879534006 CET	192.168.2.22	8.8.8.8	0x16a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.003848076 CET	192.168.2.22	8.8.8.8	0x16a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.136171103 CET	192.168.2.22	8.8.8.8	0x16a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.258908987 CET	192.168.2.22	8.8.8.8	0x16a5	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.395365953 CET	192.168.2.22	8.8.8.8	0xcd0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.519859076 CET	192.168.2.22	8.8.8.8	0xcd0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.642901897 CET	192.168.2.22	8.8.8.8	0xcd0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.768558025 CET	192.168.2.22	8.8.8.8	0xcd0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.891613007 CET	192.168.2.22	8.8.8.8	0xcd0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.039586067 CET	192.168.2.22	8.8.8.8	0xe00d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.164746046 CET	192.168.2.22	8.8.8.8	0xe00d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.288743019 CET	192.168.2.22	8.8.8.8	0xe00d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.413399935 CET	192.168.2.22	8.8.8.8	0xe00d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.538657904 CET	192.168.2.22	8.8.8.8	0xe00d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.674079895 CET	192.168.2.22	8.8.8.8	0x7802	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.800024986 CET	192.168.2.22	8.8.8.8	0x7802	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.929060936 CET	192.168.2.22	8.8.8.8	0x7802	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:58.056392908 CET	192.168.2.22	8.8.8.8	0x7802	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:58.179338932 CET	192.168.2.22	8.8.8.8	0x7802	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.316394091 CET	192.168.2.22	8.8.8.8	0x883d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.445976973 CET	192.168.2.22	8.8.8.8	0x883d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.568790913 CET	192.168.2.22	8.8.8.8	0x883d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.694982052 CET	192.168.2.22	8.8.8.8	0x883d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.828522921 CET	192.168.2.22	8.8.8.8	0x2551	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.958719015 CET	192.168.2.22	8.8.8.8	0x2551	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.081566095 CET	192.168.2.22	8.8.8.8	0x2551	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.205763102 CET	192.168.2.22	8.8.8.8	0x2551	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.330384016 CET	192.168.2.22	8.8.8.8	0x2551	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.484838009 CET	192.168.2.22	8.8.8.8	0x2aca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.607654095 CET	192.168.2.22	8.8.8.8	0x2aca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.730542898 CET	192.168.2.22	8.8.8.8	0x2aca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.853384972 CET	192.168.2.22	8.8.8.8	0x2aca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.977804899 CET	192.168.2.22	8.8.8.8	0x2aca	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:02.623975039 CET	192.168.2.22	8.8.8.8	0xd7f4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:02.957192898 CET	192.168.2.22	8.8.8.8	0xd7f4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.129492998 CET	192.168.2.22	8.8.8.8	0xd7f4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.260433912 CET	192.168.2.22	8.8.8.8	0xd7f4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.388900995 CET	192.168.2.22	8.8.8.8	0xd7f4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.539930105 CET	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.665891886 CET	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.800179005 CET	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.926100969 CET	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.061381102 CET	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.204705000 CET	192.168.2.22	8.8.8.8	0xa55c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.339355946 CET	192.168.2.22	8.8.8.8	0xa55c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.464634895 CET	192.168.2.22	8.8.8.8	0xa55c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.605914116 CET	192.168.2.22	8.8.8.8	0xa55c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.732441902 CET	192.168.2.22	8.8.8.8	0xa55c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.053839922 CET	192.168.2.22	8.8.8.8	0x37bd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.177016020 CET	192.168.2.22	8.8.8.8	0x37bd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.299709082 CET	192.168.2.22	8.8.8.8	0x37bd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.433846951 CET	192.168.2.22	8.8.8.8	0x37bd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.556991100 CET	192.168.2.22	8.8.8.8	0x37bd	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.695112944 CET	192.168.2.22	8.8.8.8	0x1009	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.817753077 CET	192.168.2.22	8.8.8.8	0x1009	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.953788996 CET	192.168.2.22	8.8.8.8	0x1009	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:08.076658964 CET	192.168.2.22	8.8.8.8	0x1009	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:08.200529099 CET	192.168.2.22	8.8.8.8	0x1009	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.589461088 CET	192.168.2.22	8.8.8.8	0x35b2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.712770939 CET	192.168.2.22	8.8.8.8	0x35b2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.838493109 CET	192.168.2.22	8.8.8.8	0x35b2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.962290049 CET	192.168.2.22	8.8.8.8	0x35b2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.086107969 CET	192.168.2.22	8.8.8.8	0x35b2	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.219770908 CET	192.168.2.22	8.8.8.8	0xcbb4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.342637062 CET	192.168.2.22	8.8.8.8	0xcbb4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.467858076 CET	192.168.2.22	8.8.8.8	0xcbb4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.590787888 CET	192.168.2.22	8.8.8.8	0xcbb4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.714226961 CET	192.168.2.22	8.8.8.8	0xcbb4	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:12.874344110 CET	192.168.2.22	8.8.8.8	0xcc4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:12.997565031 CET	192.168.2.22	8.8.8.8	0xcc4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.121471882 CET	192.168.2.22	8.8.8.8	0xcc4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.247116089 CET	192.168.2.22	8.8.8.8	0xcc4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.373883963 CET	192.168.2.22	8.8.8.8	0xcc4b	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.505451918 CET	192.168.2.22	8.8.8.8	0x2edb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.630048037 CET	192.168.2.22	8.8.8.8	0x2edb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.758560896 CET	192.168.2.22	8.8.8.8	0x2edb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.890360117 CET	192.168.2.22	8.8.8.8	0x2edb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:14.014307976 CET	192.168.2.22	8.8.8.8	0x2edb	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.149477959 CET	192.168.2.22	8.8.8.8	0x167d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.274813890 CET	192.168.2.22	8.8.8.8	0x167d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.399866104 CET	192.168.2.22	8.8.8.8	0x167d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.523854017 CET	192.168.2.22	8.8.8.8	0x167d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.658188105 CET	192.168.2.22	8.8.8.8	0x167d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.792429924 CET	192.168.2.22	8.8.8.8	0x1130	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.915863991 CET	192.168.2.22	8.8.8.8	0x1130	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.039890051 CET	192.168.2.22	8.8.8.8	0x1130	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.163863897 CET	192.168.2.22	8.8.8.8	0x1130	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.291696072 CET	192.168.2.22	8.8.8.8	0x1130	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.426740885 CET	192.168.2.22	8.8.8.8	0x4d7e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.550472021 CET	192.168.2.22	8.8.8.8	0x4d7e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.674796104 CET	192.168.2.22	8.8.8.8	0x4d7e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.798223019 CET	192.168.2.22	8.8.8.8	0x4d7e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.921869040 CET	192.168.2.22	8.8.8.8	0x4d7e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.055346012 CET	192.168.2.22	8.8.8.8	0xbc39	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.183860064 CET	192.168.2.22	8.8.8.8	0xbc39	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.322040081 CET	192.168.2.22	8.8.8.8	0xbc39	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.447381020 CET	192.168.2.22	8.8.8.8	0xbc39	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.570194006 CET	192.168.2.22	8.8.8.8	0xbc39	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:19.733756065 CET	192.168.2.22	8.8.8.8	0xc8d8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:19.858371973 CET	192.168.2.22	8.8.8.8	0xc8d8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:19.981935024 CET	192.168.2.22	8.8.8.8	0xc8d8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.105922937 CET	192.168.2.22	8.8.8.8	0xc8d8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.229300976 CET	192.168.2.22	8.8.8.8	0xc8d8	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.361288071 CET	192.168.2.22	8.8.8.8	0x31c3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.484000921 CET	192.168.2.22	8.8.8.8	0x31c3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.606558084 CET	192.168.2.22	8.8.8.8	0x31c3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.729124069 CET	192.168.2.22	8.8.8.8	0x31c3	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:21.871743917 CET	192.168.2.22	8.8.8.8	0xb854	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:21.996804953 CET	192.168.2.22	8.8.8.8	0xb854	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.127490044 CET	192.168.2.22	8.8.8.8	0xb854	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.250232935 CET	192.168.2.22	8.8.8.8	0xb854	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.373117924 CET	192.168.2.22	8.8.8.8	0xb854	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.515746117 CET	192.168.2.22	8.8.8.8	0xebc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.638726950 CET	192.168.2.22	8.8.8.8	0xebc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.762482882 CET	192.168.2.22	8.8.8.8	0xebc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.887952089 CET	192.168.2.22	8.8.8.8	0xebc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:24.014465094 CET	192.168.2.22	8.8.8.8	0xebc0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.160001040 CET	192.168.2.22	8.8.8.8	0xa5ad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.282866001 CET	192.168.2.22	8.8.8.8	0xa5ad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.406012058 CET	192.168.2.22	8.8.8.8	0xa5ad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.531636000 CET	192.168.2.22	8.8.8.8	0xa5ad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.659974098 CET	192.168.2.22	8.8.8.8	0xa5ad	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.792160034 CET	192.168.2.22	8.8.8.8	0xf9e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.919961929 CET	192.168.2.22	8.8.8.8	0xf9e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.051923037 CET	192.168.2.22	8.8.8.8	0xf9e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.175957918 CET	192.168.2.22	8.8.8.8	0xf9e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.299928904 CET	192.168.2.22	8.8.8.8	0xf9e6	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.443756104 CET	192.168.2.22	8.8.8.8	0xbf0e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.575963974 CET	192.168.2.22	8.8.8.8	0xbf0e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.703946114 CET	192.168.2.22	8.8.8.8	0xbf0e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.828056097 CET	192.168.2.22	8.8.8.8	0xbf0e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.958786964 CET	192.168.2.22	8.8.8.8	0xbf0e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.095722914 CET	192.168.2.22	8.8.8.8	0x82aa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.218713999 CET	192.168.2.22	8.8.8.8	0x82aa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.343130112 CET	192.168.2.22	8.8.8.8	0x82aa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.470148087 CET	192.168.2.22	8.8.8.8	0x82aa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.594144106 CET	192.168.2.22	8.8.8.8	0x82aa	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.730983973 CET	192.168.2.22	8.8.8.8	0x7619	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.854896069 CET	192.168.2.22	8.8.8.8	0x7619	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.977940083 CET	192.168.2.22	8.8.8.8	0x7619	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:30.103893042 CET	192.168.2.22	8.8.8.8	0x7619	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:30.229924917 CET	192.168.2.22	8.8.8.8	0x7619	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.372692108 CET	192.168.2.22	8.8.8.8	0x232d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.495955944 CET	192.168.2.22	8.8.8.8	0x232d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.619962931 CET	192.168.2.22	8.8.8.8	0x232d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.747699022 CET	192.168.2.22	8.8.8.8	0x232d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.871957064 CET	192.168.2.22	8.8.8.8	0x232d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.011827946 CET	192.168.2.22	8.8.8.8	0xebed	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.138217926 CET	192.168.2.22	8.8.8.8	0xebed	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.263883114 CET	192.168.2.22	8.8.8.8	0xebed	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.386545897 CET	192.168.2.22	8.8.8.8	0xebed	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.509207010 CET	192.168.2.22	8.8.8.8	0xebed	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:33.650275946 CET	192.168.2.22	8.8.8.8	0xa2bf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:33.773943901 CET	192.168.2.22	8.8.8.8	0xa2bf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:33.899146080 CET	192.168.2.22	8.8.8.8	0xa2bf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.022671938 CET	192.168.2.22	8.8.8.8	0xa2bf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.147088051 CET	192.168.2.22	8.8.8.8	0xa2bf	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.279696941 CET	192.168.2.22	8.8.8.8	0x9167	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.402420998 CET	192.168.2.22	8.8.8.8	0x9167	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.524987936 CET	192.168.2.22	8.8.8.8	0x9167	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.647667885 CET	192.168.2.22	8.8.8.8	0x9167	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.770443916 CET	192.168.2.22	8.8.8.8	0x9167	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:35.911766052 CET	192.168.2.22	8.8.8.8	0xa05d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.035922050 CET	192.168.2.22	8.8.8.8	0xa05d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.159899950 CET	192.168.2.22	8.8.8.8	0xa05d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.283917904 CET	192.168.2.22	8.8.8.8	0xa05d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.408709049 CET	192.168.2.22	8.8.8.8	0xa05d	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.435976028 CET	192.168.2.22	8.8.8.8	0x9674	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.558697939 CET	192.168.2.22	8.8.8.8	0x9674	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.682248116 CET	192.168.2.22	8.8.8.8	0x9674	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.813440084 CET	192.168.2.22	8.8.8.8	0xf0f1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.936115980 CET	192.168.2.22	8.8.8.8	0xf0f1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:42.154509068 CET	192.168.2.22	8.8.8.8	0xf0f1	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:43.284892082 CET	192.168.2.22	8.8.8.8	0x34d0	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:43.410018921 CET	192.168.2.22	8.8.8.8	0xd952	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:44.546780109 CET	192.168.2.22	8.8.8.8	0xf975	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:44.671396017 CET	192.168.2.22	8.8.8.8	0x83c	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:45.794974089 CET	192.168.2.22	8.8.8.8	0x182f	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:45.921022892 CET	192.168.2.22	8.8.8.8	0xc0ef	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:47.058738947 CET	192.168.2.22	8.8.8.8	0x785e	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:47.183691025 CET	192.168.2.22	8.8.8.8	0x52b7	Standard query (0)	alfredoperezpu1405.con-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 22:41:52.431972980 CET	8.8.8.8	192.168.2.22	0x541d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:53.256027937 CET	8.8.8.8	192.168.2.22	0xc1fa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:54.400695086 CET	8.8.8.8	192.168.2.22	0x857c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:54.662106037 CET	8.8.8.8	192.168.2.22	0x31d2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:55.829957962 CET	8.8.8.8	192.168.2.22	0xd774	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:55.968130112 CET	8.8.8.8	192.168.2.22	0xdc22	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:57.230364084 CET	8.8.8.8	192.168.2.22	0x6160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:57.465087891 CET	8.8.8.8	192.168.2.22	0xe680	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:58.614516020 CET	8.8.8.8	192.168.2.22	0x6219	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:41:58.992527008 CET	8.8.8.8	192.168.2.22	0x5c58	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:00.380234003 CET	8.8.8.8	192.168.2.22	0xe61d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:00.527204037 CET	8.8.8.8	192.168.2.22	0x6ea6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:01.665671110 CET	8.8.8.8	192.168.2.22	0x5fe2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:01.963444948 CET	8.8.8.8	192.168.2.22	0x6f26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:03.125463963 CET	8.8.8.8	192.168.2.22	0x5fa7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:03.274781942 CET	8.8.8.8	192.168.2.22	0xa3e2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:04.516789913 CET	8.8.8.8	192.168.2.22	0x35e8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:04.659235954 CET	8.8.8.8	192.168.2.22	0xfb93	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:05.797663927 CET	8.8.8.8	192.168.2.22	0x5094	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:05.922481060 CET	8.8.8.8	192.168.2.22	0x5986	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:07.092246056 CET	8.8.8.8	192.168.2.22	0x415e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:07.230650902 CET	8.8.8.8	192.168.2.22	0x2c65	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:08.359872103 CET	8.8.8.8	192.168.2.22	0xb0c1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:08.499254942 CET	8.8.8.8	192.168.2.22	0x3d69	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:09.623641968 CET	8.8.8.8	192.168.2.22	0xd984	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:09.759814024 CET	8.8.8.8	192.168.2.22	0x7db5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:10.998703957 CET	8.8.8.8	192.168.2.22	0xa225	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:11.486599922 CET	8.8.8.8	192.168.2.22	0x981	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:12.647360086 CET	8.8.8.8	192.168.2.22	0x2bcc	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:12.783776045 CET	8.8.8.8	192.168.2.22	0xe714	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:13.927376986 CET	8.8.8.8	192.168.2.22	0x95ca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:14.239641905 CET	8.8.8.8	192.168.2.22	0xce40	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:15.418344021 CET	8.8.8.8	192.168.2.22	0x7bdc	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:15.554037094 CET	8.8.8.8	192.168.2.22	0x23a1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:16.702367067 CET	8.8.8.8	192.168.2.22	0x4744	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:16.838324070 CET	8.8.8.8	192.168.2.22	0xb800	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:18.000422955 CET	8.8.8.8	192.168.2.22	0xb2ea	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:18.140925884 CET	8.8.8.8	192.168.2.22	0xb449	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:19.293194056 CET	8.8.8.8	192.168.2.22	0xacc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:19.431806087 CET	8.8.8.8	192.168.2.22	0x21a8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:20.615936995 CET	8.8.8.8	192.168.2.22	0x7cf9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:20.844183922 CET	8.8.8.8	192.168.2.22	0x5c41	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:21.989571095 CET	8.8.8.8	192.168.2.22	0xaafc	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:22.121160984 CET	8.8.8.8	192.168.2.22	0x6530	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:23.259655952 CET	8.8.8.8	192.168.2.22	0xddb2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:23.395432949 CET	8.8.8.8	192.168.2.22	0xdab3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:24.539165020 CET	8.8.8.8	192.168.2.22	0xbf5d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:24.734977007 CET	8.8.8.8	192.168.2.22	0xb618	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:25.875937939 CET	8.8.8.8	192.168.2.22	0xff4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:26.002310038 CET	8.8.8.8	192.168.2.22	0xa537	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:27.156604052 CET	8.8.8.8	192.168.2.22	0x54e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:27.293692112 CET	8.8.8.8	192.168.2.22	0xfc88	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:28.435700893 CET	8.8.8.8	192.168.2.22	0x8bea	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:28.574589968 CET	8.8.8.8	192.168.2.22	0x636	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:29.700963020 CET	8.8.8.8	192.168.2.22	0x8721	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:29.829909086 CET	8.8.8.8	192.168.2.22	0x8f9e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:30.975548029 CET	8.8.8.8	192.168.2.22	0x9f14	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:31.245528936 CET	8.8.8.8	192.168.2.22	0xc607	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:32.636847019 CET	8.8.8.8	192.168.2.22	0x4e63	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:32.761826038 CET	8.8.8.8	192.168.2.22	0x3b7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:33.912204027 CET	8.8.8.8	192.168.2.22	0x7126	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:34.052933931 CET	8.8.8.8	192.168.2.22	0x14bb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:35.689363956 CET	8.8.8.8	192.168.2.22	0x71a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:35.943526030 CET	8.8.8.8	192.168.2.22	0x93e7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:37.090899944 CET	8.8.8.8	192.168.2.22	0xf68b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:37.227264881 CET	8.8.8.8	192.168.2.22	0xce27	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:38.338301897 CET	8.8.8.8	192.168.2.22	0x244	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:38.475222111 CET	8.8.8.8	192.168.2.22	0x21b5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:39.529563904 CET	8.8.8.8	192.168.2.22	0xe497	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:39.666404009 CET	8.8.8.8	192.168.2.22	0x3c4f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:40.684324026 CET	8.8.8.8	192.168.2.22	0xef73	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:40.822143078 CET	8.8.8.8	192.168.2.22	0xae6e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:41.812490940 CET	8.8.8.8	192.168.2.22	0x10d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:41.948679924 CET	8.8.8.8	192.168.2.22	0xfaa7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:43.013253927 CET	8.8.8.8	192.168.2.22	0x2cbb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:43.176740885 CET	8.8.8.8	192.168.2.22	0xd2e0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:44.127194881 CET	8.8.8.8	192.168.2.22	0x687c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:44.263508081 CET	8.8.8.8	192.168.2.22	0x8006	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:45.214241982 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:45.339287996 CET	8.8.8.8	192.168.2.22	0x8b16	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:46.279623032 CET	8.8.8.8	192.168.2.22	0x16c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:46.439644098 CET	8.8.8.8	192.168.2.22	0xbc6f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:47.325125933 CET	8.8.8.8	192.168.2.22	0xf087	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:47.449986935 CET	8.8.8.8	192.168.2.22	0x4893	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:48.291904926 CET	8.8.8.8	192.168.2.22	0x2c22	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:48.421120882 CET	8.8.8.8	192.168.2.22	0xb0b7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.263103962 CET	8.8.8.8	192.168.2.22	0xf8cb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.397573948 CET	8.8.8.8	192.168.2.22	0xf8cb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:49.534318924 CET	8.8.8.8	192.168.2.22	0x13d1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.337368965 CET	8.8.8.8	192.168.2.22	0xb0f3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.462863922 CET	8.8.8.8	192.168.2.22	0x4211	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:50.586500883 CET	8.8.8.8	192.168.2.22	0x4211	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.369119883 CET	8.8.8.8	192.168.2.22	0xffad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.504126072 CET	8.8.8.8	192.168.2.22	0xffad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:51.629565001 CET	8.8.8.8	192.168.2.22	0x2516	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.380521059 CET	8.8.8.8	192.168.2.22	0x8a8f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.521677971 CET	8.8.8.8	192.168.2.22	0xeb7c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:52.644329071 CET	8.8.8.8	192.168.2.22	0xeb7c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.370729923 CET	8.8.8.8	192.168.2.22	0x1cfb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.506714106 CET	8.8.8.8	192.168.2.22	0x1cfb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.641697884 CET	8.8.8.8	192.168.2.22	0x1cfb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.766540051 CET	8.8.8.8	192.168.2.22	0x4ed3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:53.889513969 CET	8.8.8.8	192.168.2.22	0x4ed3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.023660898 CET	8.8.8.8	192.168.2.22	0x4ed3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.756026030 CET	8.8.8.8	192.168.2.22	0x705c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:54.879458904 CET	8.8.8.8	192.168.2.22	0x705c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.002635956 CET	8.8.8.8	192.168.2.22	0x705c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.136879921 CET	8.8.8.8	192.168.2.22	0x705c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.260034084 CET	8.8.8.8	192.168.2.22	0x705c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:55.974057913 CET	8.8.8.8	192.168.2.22	0x136	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.108884096 CET	8.8.8.8	192.168.2.22	0x136	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.248675108 CET	8.8.8.8	192.168.2.22	0x136	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.371551037 CET	8.8.8.8	192.168.2.22	0x136	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.494354963 CET	8.8.8.8	192.168.2.22	0x136	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.854645967 CET	8.8.8.8	192.168.2.22	0xda1d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:56.981245041 CET	8.8.8.8	192.168.2.22	0xda1d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:57.104185104 CET	8.8.8.8	192.168.2.22	0xda1d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:57.239001036 CET	8.8.8.8	192.168.2.22	0xda1d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:42:57.361891031 CET	8.8.8.8	192.168.2.22	0xda1d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.153100967 CET	8.8.8.8	192.168.2.22	0xe028	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.287298918 CET	8.8.8.8	192.168.2.22	0xe028	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.421627998 CET	8.8.8.8	192.168.2.22	0xe028	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.544487000 CET	8.8.8.8	192.168.2.22	0xe028	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.679706097 CET	8.8.8.8	192.168.2.22	0xe028	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:00.941643953 CET	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.076697111 CET	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.203183889 CET	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.337450027 CET	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:01.461675882 CET	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.231494904 CET	8.8.8.8	192.168.2.22	0x290a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.356153965 CET	8.8.8.8	192.168.2.22	0x290a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.480146885 CET	8.8.8.8	192.168.2.22	0x290a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.750086069 CET	8.8.8.8	192.168.2.22	0x290a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:02.900099039 CET	8.8.8.8	192.168.2.22	0x290a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.457032919 CET	8.8.8.8	192.168.2.22	0x9430	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.594933033 CET	8.8.8.8	192.168.2.22	0x9430	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.729274035 CET	8.8.8.8	192.168.2.22	0x9430	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.870822906 CET	8.8.8.8	192.168.2.22	0x9430	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:03.993731976 CET	8.8.8.8	192.168.2.22	0x9430	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.146296978 CET	8.8.8.8	192.168.2.22	0x26ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.269953012 CET	8.8.8.8	192.168.2.22	0x26ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.392730951 CET	8.8.8.8	192.168.2.22	0x26ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.515546083 CET	8.8.8.8	192.168.2.22	0x26ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.653959990 CET	8.8.8.8	192.168.2.22	0x26ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.785486937 CET	8.8.8.8	192.168.2.22	0xbd06	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:05.919601917 CET	8.8.8.8	192.168.2.22	0xbd06	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:06.054390907 CET	8.8.8.8	192.168.2.22	0xbd06	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:06.188316107 CET	8.8.8.8	192.168.2.22	0xbd06	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:06.311431885 CET	8.8.8.8	192.168.2.22	0xbd06	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.678056955 CET	8.8.8.8	192.168.2.22	0xcd74	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.803078890 CET	8.8.8.8	192.168.2.22	0xcd74	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:07.939773083 CET	8.8.8.8	192.168.2.22	0xcd74	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.062969923 CET	8.8.8.8	192.168.2.22	0xcd74	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.200922012 CET	8.8.8.8	192.168.2.22	0xcd74	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.346704960 CET	8.8.8.8	192.168.2.22	0x3ba7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.471338987 CET	8.8.8.8	192.168.2.22	0x3ba7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.594064951 CET	8.8.8.8	192.168.2.22	0x3ba7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.728379011 CET	8.8.8.8	192.168.2.22	0x3ba7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:08.851114988 CET	8.8.8.8	192.168.2.22	0x3ba7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.364995003 CET	8.8.8.8	192.168.2.22	0xab8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.498837948 CET	8.8.8.8	192.168.2.22	0xab8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.621973991 CET	8.8.8.8	192.168.2.22	0xab8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.756143093 CET	8.8.8.8	192.168.2.22	0xab8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:11.879769087 CET	8.8.8.8	192.168.2.22	0xab8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.023825884 CET	8.8.8.8	192.168.2.22	0x44e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.146699905 CET	8.8.8.8	192.168.2.22	0x44e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.274094105 CET	8.8.8.8	192.168.2.22	0x44e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.408231020 CET	8.8.8.8	192.168.2.22	0x44e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:12.533163071 CET	8.8.8.8	192.168.2.22	0x44e1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.749182940 CET	8.8.8.8	192.168.2.22	0xf146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.871711016 CET	8.8.8.8	192.168.2.22	0xf146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:13.994494915 CET	8.8.8.8	192.168.2.22	0xf146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.130023003 CET	8.8.8.8	192.168.2.22	0xf146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.254587889 CET	8.8.8.8	192.168.2.22	0xf146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.732043028 CET	8.8.8.8	192.168.2.22	0x5f96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.858118057 CET	8.8.8.8	192.168.2.22	0x5f96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:14.997312069 CET	8.8.8.8	192.168.2.22	0x5f96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:15.120069981 CET	8.8.8.8	192.168.2.22	0x5f96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:15.242950916 CET	8.8.8.8	192.168.2.22	0x5f96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.382205009 CET	8.8.8.8	192.168.2.22	0x6dcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.512799025 CET	8.8.8.8	192.168.2.22	0x6dcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.648135900 CET	8.8.8.8	192.168.2.22	0x6dcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.770747900 CET	8.8.8.8	192.168.2.22	0x6dcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:16.893357992 CET	8.8.8.8	192.168.2.22	0x6dcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.045054913 CET	8.8.8.8	192.168.2.22	0x5d04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.167881012 CET	8.8.8.8	192.168.2.22	0x5d04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.296668053 CET	8.8.8.8	192.168.2.22	0x5d04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.432703972 CET	8.8.8.8	192.168.2.22	0x5d04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.556504965 CET	8.8.8.8	192.168.2.22	0x5d04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.699496984 CET	8.8.8.8	192.168.2.22	0xb90b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.822340012 CET	8.8.8.8	192.168.2.22	0xb90b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:18.957133055 CET	8.8.8.8	192.168.2.22	0xb90b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:19.080952883 CET	8.8.8.8	192.168.2.22	0xb90b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:19.204739094 CET	8.8.8.8	192.168.2.22	0xb90b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.344644070 CET	8.8.8.8	192.168.2.22	0x66af	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.481385946 CET	8.8.8.8	192.168.2.22	0x66af	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.605108023 CET	8.8.8.8	192.168.2.22	0x66af	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.729974985 CET	8.8.8.8	192.168.2.22	0x66af	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:20.859123945 CET	8.8.8.8	192.168.2.22	0x66af	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.006352901 CET	8.8.8.8	192.168.2.22	0xc66c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.129482985 CET	8.8.8.8	192.168.2.22	0xc66c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.252868891 CET	8.8.8.8	192.168.2.22	0xc66c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.387880087 CET	8.8.8.8	192.168.2.22	0xc66c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:21.512440920 CET	8.8.8.8	192.168.2.22	0xc66c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.653798103 CET	8.8.8.8	192.168.2.22	0xabd3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.777791977 CET	8.8.8.8	192.168.2.22	0xabd3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:22.900562048 CET	8.8.8.8	192.168.2.22	0xabd3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:23.023722887 CET	8.8.8.8	192.168.2.22	0xabd3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:23.146385908 CET	8.8.8.8	192.168.2.22	0xabd3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.291918039 CET	8.8.8.8	192.168.2.22	0x346f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.426892996 CET	8.8.8.8	192.168.2.22	0x346f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.561189890 CET	8.8.8.8	192.168.2.22	0x346f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.683720112 CET	8.8.8.8	192.168.2.22	0x346f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.817488909 CET	8.8.8.8	192.168.2.22	0x346f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:24.959566116 CET	8.8.8.8	192.168.2.22	0x20c2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.088916063 CET	8.8.8.8	192.168.2.22	0x20c2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.211483002 CET	8.8.8.8	192.168.2.22	0x20c2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.334090948 CET	8.8.8.8	192.168.2.22	0x20c2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:25.457027912 CET	8.8.8.8	192.168.2.22	0x20c2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.605986118 CET	8.8.8.8	192.168.2.22	0xbb78	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.744479895 CET	8.8.8.8	192.168.2.22	0xbb78	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:26.879728079 CET	8.8.8.8	192.168.2.22	0xbb78	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.005590916 CET	8.8.8.8	192.168.2.22	0xbb78	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.131699085 CET	8.8.8.8	192.168.2.22	0xbb78	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.260303020 CET	8.8.8.8	192.168.2.22	0x48a4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.384027958 CET	8.8.8.8	192.168.2.22	0x48a4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.506548882 CET	8.8.8.8	192.168.2.22	0x48a4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:27.630750895 CET	8.8.8.8	192.168.2.22	0x48a4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:28.779903889 CET	8.8.8.8	192.168.2.22	0x6d6b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:28.902851105 CET	8.8.8.8	192.168.2.22	0x6d6b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:29.025384903 CET	8.8.8.8	192.168.2.22	0x6d6b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:29.149967909 CET	8.8.8.8	192.168.2.22	0x6d6b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:29.272416115 CET	8.8.8.8	192.168.2.22	0x6d6b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.420665979 CET	8.8.8.8	192.168.2.22	0xc78c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.543234110 CET	8.8.8.8	192.168.2.22	0xc78c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.669203043 CET	8.8.8.8	192.168.2.22	0xc78c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.791924000 CET	8.8.8.8	192.168.2.22	0xc78c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:30.927369118 CET	8.8.8.8	192.168.2.22	0xc78c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.055085897 CET	8.8.8.8	192.168.2.22	0xb996	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.177826881 CET	8.8.8.8	192.168.2.22	0xb996	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.311970949 CET	8.8.8.8	192.168.2.22	0xb996	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.445806980 CET	8.8.8.8	192.168.2.22	0xb996	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:31.568557024 CET	8.8.8.8	192.168.2.22	0xb996	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.730954885 CET	8.8.8.8	192.168.2.22	0x7b89	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.854151964 CET	8.8.8.8	192.168.2.22	0x7b89	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:32.978256941 CET	8.8.8.8	192.168.2.22	0x7b89	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.101578951 CET	8.8.8.8	192.168.2.22	0x7b89	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.236594915 CET	8.8.8.8	192.168.2.22	0x7b89	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.368514061 CET	8.8.8.8	192.168.2.22	0x9e8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.492146969 CET	8.8.8.8	192.168.2.22	0x9e8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.627728939 CET	8.8.8.8	192.168.2.22	0x9e8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.752286911 CET	8.8.8.8	192.168.2.22	0x9e8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:33.875696898 CET	8.8.8.8	192.168.2.22	0x9e8a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.021940947 CET	8.8.8.8	192.168.2.22	0xc5d9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.144655943 CET	8.8.8.8	192.168.2.22	0xc5d9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.278908968 CET	8.8.8.8	192.168.2.22	0xc5d9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.414623976 CET	8.8.8.8	192.168.2.22	0xc5d9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.537419081 CET	8.8.8.8	192.168.2.22	0xc5d9	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.668302059 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.790932894 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:35.925452948 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:36.060328960 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:36.182919979 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.319344997 CET	8.8.8.8	192.168.2.22	0xab8d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.442274094 CET	8.8.8.8	192.168.2.22	0xab8d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.564979076 CET	8.8.8.8	192.168.2.22	0xab8d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.687589884 CET	8.8.8.8	192.168.2.22	0xab8d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.810440063 CET	8.8.8.8	192.168.2.22	0xab8d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:37.938029051 CET	8.8.8.8	192.168.2.22	0xa259	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.060688019 CET	8.8.8.8	192.168.2.22	0xa259	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.183922052 CET	8.8.8.8	192.168.2.22	0xa259	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.306845903 CET	8.8.8.8	192.168.2.22	0xa259	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:38.433146954 CET	8.8.8.8	192.168.2.22	0xa259	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.604455948 CET	8.8.8.8	192.168.2.22	0x49f0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.739085913 CET	8.8.8.8	192.168.2.22	0x49f0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.862004995 CET	8.8.8.8	192.168.2.22	0x49f0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:39.985254049 CET	8.8.8.8	192.168.2.22	0x49f0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:40.108423948 CET	8.8.8.8	192.168.2.22	0x49f0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.248157978 CET	8.8.8.8	192.168.2.22	0x2237	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.370790005 CET	8.8.8.8	192.168.2.22	0x2237	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.493860006 CET	8.8.8.8	192.168.2.22	0x2237	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.619359970 CET	8.8.8.8	192.168.2.22	0x2237	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.742048025 CET	8.8.8.8	192.168.2.22	0x2237	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:41.893444061 CET	8.8.8.8	192.168.2.22	0x4252	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.028009892 CET	8.8.8.8	192.168.2.22	0x4252	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.150815964 CET	8.8.8.8	192.168.2.22	0x4252	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.294893026 CET	8.8.8.8	192.168.2.22	0x4252	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:42.426263094 CET	8.8.8.8	192.168.2.22	0x4252	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.558460951 CET	8.8.8.8	192.168.2.22	0xe03f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.682627916 CET	8.8.8.8	192.168.2.22	0xe03f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.806229115 CET	8.8.8.8	192.168.2.22	0xe03f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:43.928996086 CET	8.8.8.8	192.168.2.22	0xe03f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:44.052225113 CET	8.8.8.8	192.168.2.22	0xe03f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:44.195127964 CET	8.8.8.8	192.168.2.22	0x2113	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.338706017 CET	8.8.8.8	192.168.2.22	0x8af4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.463274002 CET	8.8.8.8	192.168.2.22	0x8af4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.594656944 CET	8.8.8.8	192.168.2.22	0x8af4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.724842072 CET	8.8.8.8	192.168.2.22	0x8af4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:45.847577095 CET	8.8.8.8	192.168.2.22	0x8af4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:46.997525930 CET	8.8.8.8	192.168.2.22	0x92ec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.131943941 CET	8.8.8.8	192.168.2.22	0x92ec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.270015955 CET	8.8.8.8	192.168.2.22	0x92ec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.395678997 CET	8.8.8.8	192.168.2.22	0x92ec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:47.522660017 CET	8.8.8.8	192.168.2.22	0x92ec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.679672003 CET	8.8.8.8	192.168.2.22	0x3f05	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.817967892 CET	8.8.8.8	192.168.2.22	0x3f05	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:48.943913937 CET	8.8.8.8	192.168.2.22	0x3f05	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.082175970 CET	8.8.8.8	192.168.2.22	0x3f05	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.210656881 CET	8.8.8.8	192.168.2.22	0x3f05	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.742590904 CET	8.8.8.8	192.168.2.22	0xefc3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:49.923723936 CET	8.8.8.8	192.168.2.22	0xefc3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:50.065670013 CET	8.8.8.8	192.168.2.22	0xefc3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:50.233354092 CET	8.8.8.8	192.168.2.22	0xefc3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:50.367485046 CET	8.8.8.8	192.168.2.22	0xefc3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.518030882 CET	8.8.8.8	192.168.2.22	0xe28d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.642975092 CET	8.8.8.8	192.168.2.22	0xe28d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.774154902 CET	8.8.8.8	192.168.2.22	0xe28d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:51.898730040 CET	8.8.8.8	192.168.2.22	0xe28d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.021503925 CET	8.8.8.8	192.168.2.22	0xe28d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.156286001 CET	8.8.8.8	192.168.2.22	0x342e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.282573938 CET	8.8.8.8	192.168.2.22	0x342e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.405766964 CET	8.8.8.8	192.168.2.22	0x342e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.529890060 CET	8.8.8.8	192.168.2.22	0x342e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:52.666445971 CET	8.8.8.8	192.168.2.22	0x342e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:53.961714983 CET	8.8.8.8	192.168.2.22	0x8383	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.099648952 CET	8.8.8.8	192.168.2.22	0x8383	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.226552963 CET	8.8.8.8	192.168.2.22	0x8383	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.349220991 CET	8.8.8.8	192.168.2.22	0x8383	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.485754013 CET	8.8.8.8	192.168.2.22	0x8383	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.615168095 CET	8.8.8.8	192.168.2.22	0x665f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.737876892 CET	8.8.8.8	192.168.2.22	0x665f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.872116089 CET	8.8.8.8	192.168.2.22	0x665f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:54.994762897 CET	8.8.8.8	192.168.2.22	0x665f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:55.130951881 CET	8.8.8.8	192.168.2.22	0x665f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.272452116 CET	8.8.8.8	192.168.2.22	0x5160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.411185026 CET	8.8.8.8	192.168.2.22	0x5160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.546113968 CET	8.8.8.8	192.168.2.22	0x5160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.673608065 CET	8.8.8.8	192.168.2.22	0x5160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.798616886 CET	8.8.8.8	192.168.2.22	0x5160	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:56.953457117 CET	8.8.8.8	192.168.2.22	0x7c4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.079171896 CET	8.8.8.8	192.168.2.22	0x7c4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.201944113 CET	8.8.8.8	192.168.2.22	0x7c4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.326010942 CET	8.8.8.8	192.168.2.22	0x7c4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:57.457530022 CET	8.8.8.8	192.168.2.22	0x7c4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.597589970 CET	8.8.8.8	192.168.2.22	0xf8d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.731633902 CET	8.8.8.8	192.168.2.22	0xf8d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.854231119 CET	8.8.8.8	192.168.2.22	0xf8d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:58.978138924 CET	8.8.8.8	192.168.2.22	0xf8d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.102396011 CET	8.8.8.8	192.168.2.22	0xf8d3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.239480019 CET	8.8.8.8	192.168.2.22	0x7ce0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.368835926 CET	8.8.8.8	192.168.2.22	0x7ce0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.491440058 CET	8.8.8.8	192.168.2.22	0x7ce0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.622318029 CET	8.8.8.8	192.168.2.22	0x7ce0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:43:59.746536016 CET	8.8.8.8	192.168.2.22	0x7ce0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:00.888556957 CET	8.8.8.8	192.168.2.22	0xae3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.011483908 CET	8.8.8.8	192.168.2.22	0xae3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.134367943 CET	8.8.8.8	192.168.2.22	0xae3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.257105112 CET	8.8.8.8	192.168.2.22	0xae3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.379941940 CET	8.8.8.8	192.168.2.22	0xae3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.513379097 CET	8.8.8.8	192.168.2.22	0x2dd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.640458107 CET	8.8.8.8	192.168.2.22	0x2dd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.776451111 CET	8.8.8.8	192.168.2.22	0x2dd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:01.911791086 CET	8.8.8.8	192.168.2.22	0x2dd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:02.034779072 CET	8.8.8.8	192.168.2.22	0x2dd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.529063940 CET	8.8.8.8	192.168.2.22	0xc599	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.654042959 CET	8.8.8.8	192.168.2.22	0xc599	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.781807899 CET	8.8.8.8	192.168.2.22	0xc599	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:03.905457973 CET	8.8.8.8	192.168.2.22	0xc599	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.028680086 CET	8.8.8.8	192.168.2.22	0xc599	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.163832903 CET	8.8.8.8	192.168.2.22	0x6a30	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.300276995 CET	8.8.8.8	192.168.2.22	0x6a30	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.423193932 CET	8.8.8.8	192.168.2.22	0x6a30	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.545929909 CET	8.8.8.8	192.168.2.22	0x6a30	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:04.680437088 CET	8.8.8.8	192.168.2.22	0x6a30	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:06.989500999 CET	8.8.8.8	192.168.2.22	0x6ea1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.124769926 CET	8.8.8.8	192.168.2.22	0x6ea1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.247468948 CET	8.8.8.8	192.168.2.22	0x6ea1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.370964050 CET	8.8.8.8	192.168.2.22	0x6ea1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:07.498570919 CET	8.8.8.8	192.168.2.22	0x6ea1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.657845020 CET	8.8.8.8	192.168.2.22	0x9531	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.781183958 CET	8.8.8.8	192.168.2.22	0x9531	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:08.905586958 CET	8.8.8.8	192.168.2.22	0x9531	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.028879881 CET	8.8.8.8	192.168.2.22	0x9531	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.151642084 CET	8.8.8.8	192.168.2.22	0x9531	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.312093019 CET	8.8.8.8	192.168.2.22	0xcc96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.437042952 CET	8.8.8.8	192.168.2.22	0xcc96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.588213921 CET	8.8.8.8	192.168.2.22	0xcc96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.713021040 CET	8.8.8.8	192.168.2.22	0xcc96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:09.837533951 CET	8.8.8.8	192.168.2.22	0xcc96	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.014448881 CET	8.8.8.8	192.168.2.22	0xf614	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.149418116 CET	8.8.8.8	192.168.2.22	0xf614	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.272964954 CET	8.8.8.8	192.168.2.22	0xf614	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.407804966 CET	8.8.8.8	192.168.2.22	0xf614	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.534481049 CET	8.8.8.8	192.168.2.22	0xf614	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.665518999 CET	8.8.8.8	192.168.2.22	0x587b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.788398027 CET	8.8.8.8	192.168.2.22	0x587b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:11.917915106 CET	8.8.8.8	192.168.2.22	0x587b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:12.041671991 CET	8.8.8.8	192.168.2.22	0x587b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:12.164858103 CET	8.8.8.8	192.168.2.22	0x587b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.310832024 CET	8.8.8.8	192.168.2.22	0x99ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.441665888 CET	8.8.8.8	192.168.2.22	0x99ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.575656891 CET	8.8.8.8	192.168.2.22	0x99ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.707175016 CET	8.8.8.8	192.168.2.22	0x99ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:13.836424112 CET	8.8.8.8	192.168.2.22	0x99ee	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:14.987767935 CET	8.8.8.8	192.168.2.22	0xabc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.114514112 CET	8.8.8.8	192.168.2.22	0xabc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.239378929 CET	8.8.8.8	192.168.2.22	0xabc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.362062931 CET	8.8.8.8	192.168.2.22	0xabc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.492302895 CET	8.8.8.8	192.168.2.22	0xabc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.645126104 CET	8.8.8.8	192.168.2.22	0x9b26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.773758888 CET	8.8.8.8	192.168.2.22	0x9b26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:15.897710085 CET	8.8.8.8	192.168.2.22	0x9b26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:16.030045033 CET	8.8.8.8	192.168.2.22	0x9b26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:16.170331001 CET	8.8.8.8	192.168.2.22	0x9b26	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:17.734972000 CET	8.8.8.8	192.168.2.22	0xd857	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:17.862714052 CET	8.8.8.8	192.168.2.22	0xd857	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.035240889 CET	8.8.8.8	192.168.2.22	0xd857	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.215979099 CET	8.8.8.8	192.168.2.22	0xd857	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.350111961 CET	8.8.8.8	192.168.2.22	0xd857	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.494816065 CET	8.8.8.8	192.168.2.22	0x52e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.617897034 CET	8.8.8.8	192.168.2.22	0x52e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.741385937 CET	8.8.8.8	192.168.2.22	0x52e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.864206076 CET	8.8.8.8	192.168.2.22	0x52e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:18.986943007 CET	8.8.8.8	192.168.2.22	0x52e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.124531031 CET	8.8.8.8	192.168.2.22	0x6ef1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.248928070 CET	8.8.8.8	192.168.2.22	0x6ef1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.374905109 CET	8.8.8.8	192.168.2.22	0x6ef1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.497698069 CET	8.8.8.8	192.168.2.22	0x6ef1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:20.647265911 CET	8.8.8.8	192.168.2.22	0x6ef1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.239975929 CET	8.8.8.8	192.168.2.22	0xac3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.362984896 CET	8.8.8.8	192.168.2.22	0xac3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.486278057 CET	8.8.8.8	192.168.2.22	0xac3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.610176086 CET	8.8.8.8	192.168.2.22	0xac3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:21.733169079 CET	8.8.8.8	192.168.2.22	0xac3b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:22.871078968 CET	8.8.8.8	192.168.2.22	0x758e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:22.993879080 CET	8.8.8.8	192.168.2.22	0x758e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.119862080 CET	8.8.8.8	192.168.2.22	0x758e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.245556116 CET	8.8.8.8	192.168.2.22	0x758e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.370384932 CET	8.8.8.8	192.168.2.22	0x758e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.503412008 CET	8.8.8.8	192.168.2.22	0x6a04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.627063990 CET	8.8.8.8	192.168.2.22	0x6a04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.750665903 CET	8.8.8.8	192.168.2.22	0x6a04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.873616934 CET	8.8.8.8	192.168.2.22	0x6a04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:23.996576071 CET	8.8.8.8	192.168.2.22	0x6a04	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.137461901 CET	8.8.8.8	192.168.2.22	0x65d5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.272391081 CET	8.8.8.8	192.168.2.22	0x65d5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.397408962 CET	8.8.8.8	192.168.2.22	0x65d5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.520102978 CET	8.8.8.8	192.168.2.22	0x65d5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.642782927 CET	8.8.8.8	192.168.2.22	0x65d5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.779055119 CET	8.8.8.8	192.168.2.22	0x207c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:25.902579069 CET	8.8.8.8	192.168.2.22	0x207c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:26.025566101 CET	8.8.8.8	192.168.2.22	0x207c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:26.148614883 CET	8.8.8.8	192.168.2.22	0x207c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:26.271863937 CET	8.8.8.8	192.168.2.22	0x207c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.412185907 CET	8.8.8.8	192.168.2.22	0xa64d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.544063091 CET	8.8.8.8	192.168.2.22	0xa64d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.672327042 CET	8.8.8.8	192.168.2.22	0xa64d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.798394918 CET	8.8.8.8	192.168.2.22	0xa64d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:27.921849966 CET	8.8.8.8	192.168.2.22	0xa64d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.054641008 CET	8.8.8.8	192.168.2.22	0xd1f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.256736994 CET	8.8.8.8	192.168.2.22	0xd1f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.384910107 CET	8.8.8.8	192.168.2.22	0xd1f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.511723995 CET	8.8.8.8	192.168.2.22	0xd1f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:28.639990091 CET	8.8.8.8	192.168.2.22	0xd1f5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:29.785737991 CET	8.8.8.8	192.168.2.22	0x767	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:29.915658951 CET	8.8.8.8	192.168.2.22	0x767	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.038935900 CET	8.8.8.8	192.168.2.22	0x767	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.172885895 CET	8.8.8.8	192.168.2.22	0x767	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.297538042 CET	8.8.8.8	192.168.2.22	0x767	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.428673029 CET	8.8.8.8	192.168.2.22	0x7a4a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.551529884 CET	8.8.8.8	192.168.2.22	0x7a4a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.674355030 CET	8.8.8.8	192.168.2.22	0x7a4a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.798356056 CET	8.8.8.8	192.168.2.22	0x7a4a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:30.924803972 CET	8.8.8.8	192.168.2.22	0x7a4a	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.055943012 CET	8.8.8.8	192.168.2.22	0x9cec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.178853035 CET	8.8.8.8	192.168.2.22	0x9cec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.312932014 CET	8.8.8.8	192.168.2.22	0x9cec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.438555002 CET	8.8.8.8	192.168.2.22	0x9cec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.566488028 CET	8.8.8.8	192.168.2.22	0x9cec	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.698543072 CET	8.8.8.8	192.168.2.22	0x5f29	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.823822021 CET	8.8.8.8	192.168.2.22	0x5f29	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:32.964035988 CET	8.8.8.8	192.168.2.22	0x5f29	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:33.092318058 CET	8.8.8.8	192.168.2.22	0x5f29	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:33.218278885 CET	8.8.8.8	192.168.2.22	0x5f29	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.370702028 CET	8.8.8.8	192.168.2.22	0x40d4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.495166063 CET	8.8.8.8	192.168.2.22	0x40d4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.617899895 CET	8.8.8.8	192.168.2.22	0x40d4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.742191076 CET	8.8.8.8	192.168.2.22	0x40d4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:34.871597052 CET	8.8.8.8	192.168.2.22	0x40d4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.026427031 CET	8.8.8.8	192.168.2.22	0x5104	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.154664040 CET	8.8.8.8	192.168.2.22	0x5104	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.282082081 CET	8.8.8.8	192.168.2.22	0x5104	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.426525116 CET	8.8.8.8	192.168.2.22	0x5104	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:36.551413059 CET	8.8.8.8	192.168.2.22	0x5104	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.698072910 CET	8.8.8.8	192.168.2.22	0xfcbd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.823875904 CET	8.8.8.8	192.168.2.22	0xfcbd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:37.953643084 CET	8.8.8.8	192.168.2.22	0xfcbd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.084641933 CET	8.8.8.8	192.168.2.22	0xfcbd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.219140053 CET	8.8.8.8	192.168.2.22	0xfcbd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.355882883 CET	8.8.8.8	192.168.2.22	0xe792	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.482482910 CET	8.8.8.8	192.168.2.22	0xe792	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.605319977 CET	8.8.8.8	192.168.2.22	0xe792	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.728607893 CET	8.8.8.8	192.168.2.22	0xe792	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:38.851308107 CET	8.8.8.8	192.168.2.22	0xe792	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:39.982500076 CET	8.8.8.8	192.168.2.22	0x5c20	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.105588913 CET	8.8.8.8	192.168.2.22	0x5c20	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.229223013 CET	8.8.8.8	192.168.2.22	0x5c20	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.352989912 CET	8.8.8.8	192.168.2.22	0x5c20	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:40.478219032 CET	8.8.8.8	192.168.2.22	0x5c20	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.636734962 CET	8.8.8.8	192.168.2.22	0x4b4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.759974003 CET	8.8.8.8	192.168.2.22	0x4b4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:41.891719103 CET	8.8.8.8	192.168.2.22	0x4b4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.017198086 CET	8.8.8.8	192.168.2.22	0x4b4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.147921085 CET	8.8.8.8	192.168.2.22	0x4b4e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.312752008 CET	8.8.8.8	192.168.2.22	0xe146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.435724020 CET	8.8.8.8	192.168.2.22	0xe146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.574317932 CET	8.8.8.8	192.168.2.22	0xe146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.701142073 CET	8.8.8.8	192.168.2.22	0xe146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:42.828346014 CET	8.8.8.8	192.168.2.22	0xe146	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:43.973191977 CET	8.8.8.8	192.168.2.22	0x3d5c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.096481085 CET	8.8.8.8	192.168.2.22	0x3d5c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.219630003 CET	8.8.8.8	192.168.2.22	0x3d5c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.342411041 CET	8.8.8.8	192.168.2.22	0x3d5c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.477654934 CET	8.8.8.8	192.168.2.22	0x3d5c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.610774994 CET	8.8.8.8	192.168.2.22	0x1327	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.733381987 CET	8.8.8.8	192.168.2.22	0x1327	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.856194973 CET	8.8.8.8	192.168.2.22	0x1327	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:44.980159044 CET	8.8.8.8	192.168.2.22	0x1327	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:45.103600979 CET	8.8.8.8	192.168.2.22	0x1327	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.239038944 CET	8.8.8.8	192.168.2.22	0x534	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.365514994 CET	8.8.8.8	192.168.2.22	0x534	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.495771885 CET	8.8.8.8	192.168.2.22	0x534	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.620882988 CET	8.8.8.8	192.168.2.22	0x534	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.746129036 CET	8.8.8.8	192.168.2.22	0x534	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:46.883265018 CET	8.8.8.8	192.168.2.22	0xba4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.012136936 CET	8.8.8.8	192.168.2.22	0xba4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.136055946 CET	8.8.8.8	192.168.2.22	0xba4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.258790016 CET	8.8.8.8	192.168.2.22	0xba4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:47.388586998 CET	8.8.8.8	192.168.2.22	0xba4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.533440113 CET	8.8.8.8	192.168.2.22	0xe766	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.656059980 CET	8.8.8.8	192.168.2.22	0xe766	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.778718948 CET	8.8.8.8	192.168.2.22	0xe766	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:48.906251907 CET	8.8.8.8	192.168.2.22	0xe766	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.034547091 CET	8.8.8.8	192.168.2.22	0xe766	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.169898987 CET	8.8.8.8	192.168.2.22	0x874b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.294555902 CET	8.8.8.8	192.168.2.22	0x874b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.420949936 CET	8.8.8.8	192.168.2.22	0x874b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.546571016 CET	8.8.8.8	192.168.2.22	0x874b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:49.669610023 CET	8.8.8.8	192.168.2.22	0x874b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:50.844264984 CET	8.8.8.8	192.168.2.22	0x6e24	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:50.975009918 CET	8.8.8.8	192.168.2.22	0x6e24	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.107072115 CET	8.8.8.8	192.168.2.22	0x6e24	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.238219023 CET	8.8.8.8	192.168.2.22	0x6e24	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.380547047 CET	8.8.8.8	192.168.2.22	0x6e24	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.538857937 CET	8.8.8.8	192.168.2.22	0x7332	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.668603897 CET	8.8.8.8	192.168.2.22	0x7332	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.795589924 CET	8.8.8.8	192.168.2.22	0x7332	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:51.933440924 CET	8.8.8.8	192.168.2.22	0x7332	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:52.063272953 CET	8.8.8.8	192.168.2.22	0x7332	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.211412907 CET	8.8.8.8	192.168.2.22	0x1fcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.345494986 CET	8.8.8.8	192.168.2.22	0x1fcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.480201006 CET	8.8.8.8	192.168.2.22	0x1fcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.615907907 CET	8.8.8.8	192.168.2.22	0x1fcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.744781971 CET	8.8.8.8	192.168.2.22	0x1fcf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:53.879162073 CET	8.8.8.8	192.168.2.22	0x16a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.002794981 CET	8.8.8.8	192.168.2.22	0x16a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.133625031 CET	8.8.8.8	192.168.2.22	0x16a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.258676052 CET	8.8.8.8	192.168.2.22	0x16a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:54.382441044 CET	8.8.8.8	192.168.2.22	0x16a5	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.518155098 CET	8.8.8.8	192.168.2.22	0xcd0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.642527103 CET	8.8.8.8	192.168.2.22	0xcd0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.767190933 CET	8.8.8.8	192.168.2.22	0xcd0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:55.891391039 CET	8.8.8.8	192.168.2.22	0xcd0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:56.014621019 CET	8.8.8.8	192.168.2.22	0xcd0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.164544106 CET	8.8.8.8	192.168.2.22	0xe00d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.288551092 CET	8.8.8.8	192.168.2.22	0xe00d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.413137913 CET	8.8.8.8	192.168.2.22	0xe00d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.538497925 CET	8.8.8.8	192.168.2.22	0xe00d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.664582968 CET	8.8.8.8	192.168.2.22	0xe00d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.799865007 CET	8.8.8.8	192.168.2.22	0x7802	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:57.928814888 CET	8.8.8.8	192.168.2.22	0x7802	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:58.056209087 CET	8.8.8.8	192.168.2.22	0x7802	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:58.179163933 CET	8.8.8.8	192.168.2.22	0x7802	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:58.302778959 CET	8.8.8.8	192.168.2.22	0x7802	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.445764065 CET	8.8.8.8	192.168.2.22	0x883d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.568619013 CET	8.8.8.8	192.168.2.22	0x883d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.694811106 CET	8.8.8.8	192.168.2.22	0x883d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.818675995 CET	8.8.8.8	192.168.2.22	0x883d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:44:59.951143980 CET	8.8.8.8	192.168.2.22	0x2551	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.081394911 CET	8.8.8.8	192.168.2.22	0x2551	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.205602884 CET	8.8.8.8	192.168.2.22	0x2551	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.330046892 CET	8.8.8.8	192.168.2.22	0x2551	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:00.461791039 CET	8.8.8.8	192.168.2.22	0x2551	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.607443094 CET	8.8.8.8	192.168.2.22	0x2aca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.730353117 CET	8.8.8.8	192.168.2.22	0x2aca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.853204012 CET	8.8.8.8	192.168.2.22	0x2aca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:01.977627039 CET	8.8.8.8	192.168.2.22	0x2aca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:02.100620031 CET	8.8.8.8	192.168.2.22	0x2aca	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:02.759486914 CET	8.8.8.8	192.168.2.22	0xd7f4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.099929094 CET	8.8.8.8	192.168.2.22	0xd7f4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.259942055 CET	8.8.8.8	192.168.2.22	0xd7f4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.388597012 CET	8.8.8.8	192.168.2.22	0xd7f4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:03.526256084 CET	8.8.8.8	192.168.2.22	0xd7f4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.663634062 CET	8.8.8.8	192.168.2.22	0x52f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.799896955 CET	8.8.8.8	192.168.2.22	0x52f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:04.923935890 CET	8.8.8.8	192.168.2.22	0x52f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.061105013 CET	8.8.8.8	192.168.2.22	0x52f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.196122885 CET	8.8.8.8	192.168.2.22	0x52f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.339190960 CET	8.8.8.8	192.168.2.22	0xa55c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.462474108 CET	8.8.8.8	192.168.2.22	0xa55c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.605736017 CET	8.8.8.8	192.168.2.22	0xa55c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.732238054 CET	8.8.8.8	192.168.2.22	0xa55c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:05.867222071 CET	8.8.8.8	192.168.2.22	0xa55c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.176774979 CET	8.8.8.8	192.168.2.22	0x37bd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.299504995 CET	8.8.8.8	192.168.2.22	0x37bd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.433656931 CET	8.8.8.8	192.168.2.22	0x37bd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.556802988 CET	8.8.8.8	192.168.2.22	0x37bd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.679683924 CET	8.8.8.8	192.168.2.22	0x37bd	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.817584038 CET	8.8.8.8	192.168.2.22	0x1009	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:07.953624010 CET	8.8.8.8	192.168.2.22	0x1009	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:08.076469898 CET	8.8.8.8	192.168.2.22	0x1009	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:08.200375080 CET	8.8.8.8	192.168.2.22	0x1009	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:08.331455946 CET	8.8.8.8	192.168.2.22	0x1009	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.712587118 CET	8.8.8.8	192.168.2.22	0x35b2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.838315964 CET	8.8.8.8	192.168.2.22	0x35b2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:10.962117910 CET	8.8.8.8	192.168.2.22	0x35b2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.085819960 CET	8.8.8.8	192.168.2.22	0x35b2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.209233046 CET	8.8.8.8	192.168.2.22	0x35b2	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.342340946 CET	8.8.8.8	192.168.2.22	0xcbb4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.467267990 CET	8.8.8.8	192.168.2.22	0xcbb4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.590616941 CET	8.8.8.8	192.168.2.22	0xcbb4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.714055061 CET	8.8.8.8	192.168.2.22	0xcbb4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:11.837676048 CET	8.8.8.8	192.168.2.22	0xcbb4	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:12.997339964 CET	8.8.8.8	192.168.2.22	0xcc4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.121251106 CET	8.8.8.8	192.168.2.22	0xcc4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.246927977 CET	8.8.8.8	192.168.2.22	0xcc4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.371977091 CET	8.8.8.8	192.168.2.22	0xcc4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.497890949 CET	8.8.8.8	192.168.2.22	0xcc4b	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.629019976 CET	8.8.8.8	192.168.2.22	0x2edb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.753768921 CET	8.8.8.8	192.168.2.22	0x2edb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:13.881236076 CET	8.8.8.8	192.168.2.22	0x2edb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:14.013149977 CET	8.8.8.8	192.168.2.22	0x2edb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:14.137351990 CET	8.8.8.8	192.168.2.22	0x2edb	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.272078037 CET	8.8.8.8	192.168.2.22	0x167d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.397327900 CET	8.8.8.8	192.168.2.22	0x167d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.522411108 CET	8.8.8.8	192.168.2.22	0x167d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.658008099 CET	8.8.8.8	192.168.2.22	0x167d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.780560017 CET	8.8.8.8	192.168.2.22	0x167d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:15.915047884 CET	8.8.8.8	192.168.2.22	0x1130	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.038538933 CET	8.8.8.8	192.168.2.22	0x1130	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.162271023 CET	8.8.8.8	192.168.2.22	0x1130	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.286515951 CET	8.8.8.8	192.168.2.22	0x1130	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:16.417552948 CET	8.8.8.8	192.168.2.22	0x1130	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.550061941 CET	8.8.8.8	192.168.2.22	0x4d7e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.673789024 CET	8.8.8.8	192.168.2.22	0x4d7e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.797616005 CET	8.8.8.8	192.168.2.22	0x4d7e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:17.920892000 CET	8.8.8.8	192.168.2.22	0x4d7e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.045931101 CET	8.8.8.8	192.168.2.22	0x4d7e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.177941084 CET	8.8.8.8	192.168.2.22	0xbc39	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.318202019 CET	8.8.8.8	192.168.2.22	0xbc39	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.447195053 CET	8.8.8.8	192.168.2.22	0xbc39	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.570028067 CET	8.8.8.8	192.168.2.22	0xbc39	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:18.693500996 CET	8.8.8.8	192.168.2.22	0xbc39	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:19.857412100 CET	8.8.8.8	192.168.2.22	0xc8d8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:19.980935097 CET	8.8.8.8	192.168.2.22	0xc8d8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.104726076 CET	8.8.8.8	192.168.2.22	0xc8d8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.229099035 CET	8.8.8.8	192.168.2.22	0xc8d8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.352229118 CET	8.8.8.8	192.168.2.22	0xc8d8	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.483831882 CET	8.8.8.8	192.168.2.22	0x31c3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.606414080 CET	8.8.8.8	192.168.2.22	0x31c3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.728948116 CET	8.8.8.8	192.168.2.22	0x31c3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:20.851521969 CET	8.8.8.8	192.168.2.22	0x31c3	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:21.996212959 CET	8.8.8.8	192.168.2.22	0xb854	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.119257927 CET	8.8.8.8	192.168.2.22	0xb854	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.249844074 CET	8.8.8.8	192.168.2.22	0xb854	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.372970104 CET	8.8.8.8	192.168.2.22	0xb854	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:22.498006105 CET	8.8.8.8	192.168.2.22	0xb854	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.638358116 CET	8.8.8.8	192.168.2.22	0xebc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.761142969 CET	8.8.8.8	192.168.2.22	0xebc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:23.885114908 CET	8.8.8.8	192.168.2.22	0xebc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:24.010612965 CET	8.8.8.8	192.168.2.22	0xebc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:24.138200998 CET	8.8.8.8	192.168.2.22	0xebc0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.282656908 CET	8.8.8.8	192.168.2.22	0xa5ad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.405311108 CET	8.8.8.8	192.168.2.22	0xa5ad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.529057980 CET	8.8.8.8	192.168.2.22	0xa5ad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.656447887 CET	8.8.8.8	192.168.2.22	0xa5ad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.782582045 CET	8.8.8.8	192.168.2.22	0xa5ad	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:25.917692900 CET	8.8.8.8	192.168.2.22	0xf9e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.050820112 CET	8.8.8.8	192.168.2.22	0xf9e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.174455881 CET	8.8.8.8	192.168.2.22	0xf9e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.298827887 CET	8.8.8.8	192.168.2.22	0xf9e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:26.426004887 CET	8.8.8.8	192.168.2.22	0xf9e6	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.572145939 CET	8.8.8.8	192.168.2.22	0xbf0e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.698718071 CET	8.8.8.8	192.168.2.22	0xbf0e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.826412916 CET	8.8.8.8	192.168.2.22	0xbf0e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:27.950998068 CET	8.8.8.8	192.168.2.22	0xbf0e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:28.081641912 CET	8.8.8.8	192.168.2.22	0xbf0e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.218525887 CET	8.8.8.8	192.168.2.22	0x82aa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.341439009 CET	8.8.8.8	192.168.2.22	0x82aa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.465980053 CET	8.8.8.8	192.168.2.22	0x82aa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.593890905 CET	8.8.8.8	192.168.2.22	0x82aa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.720740080 CET	8.8.8.8	192.168.2.22	0x82aa	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.853655100 CET	8.8.8.8	192.168.2.22	0x7619	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:29.977442026 CET	8.8.8.8	192.168.2.22	0x7619	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:30.100660086 CET	8.8.8.8	192.168.2.22	0x7619	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:30.226457119 CET	8.8.8.8	192.168.2.22	0x7619	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:30.352663040 CET	8.8.8.8	192.168.2.22	0x7619	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.495248079 CET	8.8.8.8	192.168.2.22	0x232d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.618379116 CET	8.8.8.8	192.168.2.22	0x232d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.742407084 CET	8.8.8.8	192.168.2.22	0x232d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.869993925 CET	8.8.8.8	192.168.2.22	0x232d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:31.995028973 CET	8.8.8.8	192.168.2.22	0x232d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.135937929 CET	8.8.8.8	192.168.2.22	0xebed	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.260597944 CET	8.8.8.8	192.168.2.22	0xebed	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.386348963 CET	8.8.8.8	192.168.2.22	0xebed	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.509006023 CET	8.8.8.8	192.168.2.22	0xebed	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:32.632206917 CET	8.8.8.8	192.168.2.22	0xebed	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:33.772728920 CET	8.8.8.8	192.168.2.22	0xa2bf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:33.896398067 CET	8.8.8.8	192.168.2.22	0xa2bf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.021536112 CET	8.8.8.8	192.168.2.22	0xa2bf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.145365953 CET	8.8.8.8	192.168.2.22	0xa2bf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.270790100 CET	8.8.8.8	192.168.2.22	0xa2bf	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.402206898 CET	8.8.8.8	192.168.2.22	0x9167	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.524761915 CET	8.8.8.8	192.168.2.22	0x9167	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.647465944 CET	8.8.8.8	192.168.2.22	0x9167	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.770165920 CET	8.8.8.8	192.168.2.22	0x9167	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:34.892844915 CET	8.8.8.8	192.168.2.22	0x9167	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.034218073 CET	8.8.8.8	192.168.2.22	0xa05d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.158436060 CET	8.8.8.8	192.168.2.22	0xa05d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.282759905 CET	8.8.8.8	192.168.2.22	0xa05d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:36.408555984 CET	8.8.8.8	192.168.2.22	0xa05d	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.558509111 CET	8.8.8.8	192.168.2.22	0x9674	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.682077885 CET	8.8.8.8	192.168.2.22	0x9674	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.807238102 CET	8.8.8.8	192.168.2.22	0x9674	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:41.935904980 CET	8.8.8.8	192.168.2.22	0xf0f1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:42.058497906 CET	8.8.8.8	192.168.2.22	0xf0f1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:42.276977062 CET	8.8.8.8	192.168.2.22	0xf0f1	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:43.408405066 CET	8.8.8.8	192.168.2.22	0x34d0	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:43.532402039 CET	8.8.8.8	192.168.2.22	0xd952	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:44.669850111 CET	8.8.8.8	192.168.2.22	0xf975	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:44.793765068 CET	8.8.8.8	192.168.2.22	0x83c	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:45.917561054 CET	8.8.8.8	192.168.2.22	0x182f	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:46.043620110 CET	8.8.8.8	192.168.2.22	0xc0ef	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:47.182219982 CET	8.8.8.8	192.168.2.22	0x785e	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 22:45:47.306103945 CET	8.8.8.8	192.168.2.22	0x52b7	No error (0)	alfredoperezpu1405.con-ip.com	0.0.0.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	16:41:34
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"
Imagebase:	0x400000
File size:	7'649'280 bytes
MD5 hash:	FB652B5FF3A97EBBB8C9BF69C7010C1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.352200957.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000002.405329214.0000000002630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.405058019.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.405178502.0000000000ADF000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:41:51
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe"
Imagebase:	0x400000
File size:	7'649'280 bytes
MD5 hash:	FB652B5FF3A97EBBB8C9BF69C7010C1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.882045254.000000000283F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.881970203.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	45.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	385

Executed Functions

Function 00B9A239 Relevance: 107.8, APIs: 1, Strings: 60, Instructions: 1069
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
e, xrefs: 00B9A266
l, xrefs: 00B9AF70
e, xrefs: 00B9A251
a, xrefs: 00B9C82A
F, xrefs: 00B9AF62
x, xrefs: 00BAE219
h, xrefs: 00B9A29E
e, xrefs: 00B9A2AC
G, xrefs: 00B9AF23
o, xrefs: 00B9AF3F
t, xrefs: 00BAE227
C, xrefs: 00B9A243
i, xrefs: 00BAE220
e, xrefs: 00B9AF77
L, xrefs: 00B9C838
E, xrefs: 00BAE212
e, xrefs: 00B9A290
m, xrefs: 00B9AF8C
e, xrefs: 00B9AF2A
t, xrefs: 00B9A25F
u, xrefs: 00B9AF4D
o, xrefs: 00BAE23C
t, xrefs: 00B9A289
T, xrefs: 00B9A297
o, xrefs: 00B9C823
l, xrefs: 00B9AF54
e, xrefs: 00BAE24A
e, xrefs: 00B9AF93
N, xrefs: 00B9AF7E
d, xrefs: 00B9C831
r, xrefs: 00B9C85B
e, xrefs: 00B9AF5B
a, xrefs: 00B9A258
m, xrefs: 00B9A27B
i, xrefs: 00B9AF69
o, xrefs: 00B9A282
b, xrefs: 00B9C846
W, xrefs: 00B9AF9A
jjjj, xrefs: 00B9D792
c, xrefs: 00BAE243
s, xrefs: 00BAE251
e, xrefs: 00B9A274
M, xrefs: 00B9AF38
d, xrefs: 00B9AF46
a, xrefs: 00B9A2B3
d, xrefs: 00B9A2BA
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
y, xrefs: 00B9C862
a, xrefs: 00B9C854
a, xrefs: 00B9AF85
t, xrefs: 00B9AF31
R, xrefs: 00B9A26D
r, xrefs: 00B9A2A5
r, xrefs: 00B9C84D
r, xrefs: 00B9A24A
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: C$E$F$G$L$L$M$N$P$R$T$W$W$a$a$a$a$a$b$c$d$d$d$e$e$e$e$e$e$e$e$e$e$h$i$i$i$jjjj$l$l$m$m$o$o$o$o$r$r$r$r$r$s$s$t$t$t$t$u$x$y
API String ID: 0-4044928391
Opcode ID: d690ebdd1fcd0a74585fb3819a60ddbcbaec3b31860d5d043a602fa3cf6727ee
Instruction ID: 35cd74a24197afce117007b7012185f7832406bc974671664d4895a520400cfd
Opcode Fuzzy Hash: d690ebdd1fcd0a74585fb3819a60ddbcbaec3b31860d5d043a602fa3cf6727ee
Instruction Fuzzy Hash: BDA24411E2866887DB28CB39CC1979AB7B2EF55300F0494FD840DE7661EB754BC98F1A

Function 00BAA220 Relevance: 80.9, APIs: 1, Strings: 45, Instructions: 426
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

e, xrefs: 00BAA608
r, xrefs: 00BAE235
o, xrefs: 00BAA5FA
a, xrefs: 00BAAAB8
s, xrefs: 00BAA616
W, xrefs: 00BAAAF7
S, xrefs: 00BAA61D
u, xrefs: 00BAA5B4
D, xrefs: 00BAA59F
i, xrefs: 00BAA5D7
o, xrefs: 00BAAAB1
d, xrefs: 00BAAABF
L, xrefs: 00BAAAC6
x, xrefs: 00BAE219
e, xrefs: 00BAA5A6
a, xrefs: 00BAAAE2
b, xrefs: 00BAAAD4
c, xrefs: 00BAE243
P, xrefs: 00BAA5EC
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
E, xrefs: 00BAE212
r, xrefs: 00BAAADB
e, xrefs: 00BAA5E5
c, xrefs: 00BAA601
r, xrefs: 00BAA5F3
o, xrefs: 00BAA62B
t, xrefs: 00BAA624
v, xrefs: 00BAA5DE
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
y, xrefs: 00BAAAF0
b, xrefs: 00BAA5AD
s, xrefs: 00BAA60F
L, xrefs: 00BAAAAA
e, xrefs: 00BAE24A
p, xrefs: 00BAA632
A, xrefs: 00BAA5C2
t, xrefs: 00BAA5D0
c, xrefs: 00BAA5C9
i, xrefs: 00BAAACD
r, xrefs: 00BAAAE9
g, xrefs: 00BAA5BB
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: A$D$E$L$L$P$P$S$W$a$a$b$b$c$c$c$d$e$e$e$e$g$i$i$i$o$o$o$o$p$r$r$r$r$s$s$s$s$t$t$t$u$v$x$y
API String ID: 3559483778-594397011
Opcode ID: d3460c1c92533dac55d5359c062e47c3b2a473b8cced3876ae544327cdc92b0f
Instruction ID: 4aaf960018adb6e1b40c72fbe8a3b80145b0f1b21dd8d30f4176064dea03e0ea
Opcode Fuzzy Hash: d3460c1c92533dac55d5359c062e47c3b2a473b8cced3876ae544327cdc92b0f
Instruction Fuzzy Hash: 2612BD70D082A88EEB258B14CC88BEABBB5EF56304F1440EAD44D67681D3795FC5CF66

Function 00B9B1C7 Relevance: 67.1, APIs: 1, Strings: 37, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
W, xrefs: 00B9B46B
r, xrefs: 00B9C85B
o, xrefs: 00B9B425
a, xrefs: 00B9C82A
L, xrefs: 00B9B43A
b, xrefs: 00B9C846
x, xrefs: 00BAE219
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
L, xrefs: 00B9C838
y, xrefs: 00B9B464
E, xrefs: 00BAE212
L, xrefs: 00B9C81C
r, xrefs: 00B9B44F
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
i, xrefs: 00B9B441
W, xrefs: 00B9C869
d, xrefs: 00B9B433
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
a, xrefs: 00B9B42C
a, xrefs: 00B9C854
o, xrefs: 00B9C823
e, xrefs: 00BAE24A
r, xrefs: 00B9B45D
d, xrefs: 00B9C831
b, xrefs: 00B9B448
a, xrefs: 00B9B456
L, xrefs: 00B9B41E
?:EB, xrefs: 00B9B288
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: ?:EB$E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$jjjj$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-1743045164
Opcode ID: 1696a5ed221e771a8acdf5f52a36af0215c391b2620d1f05738313e28e7165b5
Instruction ID: 4523e1a495217c9b0c3cfc888a694cef4b0d7801bc16a753755aa098e5c59d6f
Opcode Fuzzy Hash: 1696a5ed221e771a8acdf5f52a36af0215c391b2620d1f05738313e28e7165b5
Instruction Fuzzy Hash: 7A3218A1D082688AEB248B24DD58BFA7BB5EF51300F1440FAD54DA7281D7BD4EC5CF22

Function 00B6117E Relevance: 65.5, APIs: 2, Strings: 35, Instructions: 711libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 487a70a4152505f08ac4eb0fec03df62120ec3a3b0ad4c85ba18dd2110fc5495
Instruction ID: 0fa8f10ce5bb457a8078118ba98acef7c57ce6ee4c88cf2f508a38bb26fa9f75
Opcode Fuzzy Hash: 487a70a4152505f08ac4eb0fec03df62120ec3a3b0ad4c85ba18dd2110fc5495
Instruction Fuzzy Hash: B552F561D186948BF7218B24DC547EB7AB5EF91300F0880F9D48DA7682DA7E4FC58F62

Function 00B60D45 Relevance: 65.5, APIs: 2, Strings: 35, Instructions: 708libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 35f9ed7f762b27f0305948070dec0ba6869af6dff1e7b76476db9ce1578210d0
Instruction ID: 821b08c18f2b7624521e12c03b7538f4b4aebe7312ac08492f716d9f2741bf95
Opcode Fuzzy Hash: 35f9ed7f762b27f0305948070dec0ba6869af6dff1e7b76476db9ce1578210d0
Instruction Fuzzy Hash: 9852F6A1D186948BF7218B24DC557EB7AB5EF91300F0880F9D48D97282DA7E4FC58F62

Function 00B611C5 Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 691libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 7b6a2bbabaf9cc1aa7a996c2543fe190f1fd5ddcefc5cbb6cc9f62121af6bf85
Instruction ID: bc381e71b92e3e9fdce7ae0908540c19dee9ad569403fbfbbc44002f1f9c468e
Opcode Fuzzy Hash: 7b6a2bbabaf9cc1aa7a996c2543fe190f1fd5ddcefc5cbb6cc9f62121af6bf85
Instruction Fuzzy Hash: 9652F461D086948BF7218B24DC557EB7AB5EF91300F0480F9D48DAB282DA7E5FC58F62

Function 00B61899 Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 690libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 99fb0810bacfee0363a13ca1210e1f2a0ea51f803c82ccf6b537aa8c9775dde2
Instruction ID: c1a56dc90a44d4549b7ae899c5d751596eaebf0cefb3b95fb30fe8f9d1b96e0d
Opcode Fuzzy Hash: 99fb0810bacfee0363a13ca1210e1f2a0ea51f803c82ccf6b537aa8c9775dde2
Instruction Fuzzy Hash: 5752E461D086948BF7218B24DC557EB7AB5EF91300F0480F9D48DA7282DA7E5FC58F62

Function 00B6163D Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 688libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: c836e1015d63a34ff1daa7e8742138b7a84b1f233565c8f59eb498b763ff1a52
Instruction ID: 461454ce979184ce36b24d9cfb1dd269d4ee4226c214ed32538b6c5389009a4b
Opcode Fuzzy Hash: c836e1015d63a34ff1daa7e8742138b7a84b1f233565c8f59eb498b763ff1a52
Instruction Fuzzy Hash: DC52E461D086948BF7218B24DC557EB7AB5EF91300F0480F9D48DA7282DA7E5FC58F62

Function 00B61618 Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 688libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 5a7e8cddb78d836e9acf5d0db73e24a4256d71f61277ad6cafb6209344d3799a
Instruction ID: 922cc9e15e8cae4cc2da9a967febe56354b62532789afcbf654f97378c2a3782
Opcode Fuzzy Hash: 5a7e8cddb78d836e9acf5d0db73e24a4256d71f61277ad6cafb6209344d3799a
Instruction Fuzzy Hash: 1152E461D086948BF7218B24DC547EB7AB5EF91300F0480F9D48DA7282DA7E5FC58F62

Function 00B615BE Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 688libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 1aeb4a7e5ba964c5a6033355a80d112d4d970c1163b5744c18b9731de1f1b10c
Instruction ID: 62730fd4f0f6711522debb6c145e90ddc66e8931d139a7c8ffbb767166eddd9f
Opcode Fuzzy Hash: 1aeb4a7e5ba964c5a6033355a80d112d4d970c1163b5744c18b9731de1f1b10c
Instruction Fuzzy Hash: FA52E461D086948BF7218B24DC557EB7AB5EF91300F0480F9D48DA7282DA7E5FC58F62

Function 00B615E6 Relevance: 65.4, APIs: 2, Strings: 35, Instructions: 688libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00B618DF
LoadLibraryW.KERNEL32(FFFFF55C), ref: 00B618FC

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 1029625771-3159857985
Opcode ID: 1aeb4a7e5ba964c5a6033355a80d112d4d970c1163b5744c18b9731de1f1b10c
Instruction ID: 62730fd4f0f6711522debb6c145e90ddc66e8931d139a7c8ffbb767166eddd9f
Opcode Fuzzy Hash: 1aeb4a7e5ba964c5a6033355a80d112d4d970c1163b5744c18b9731de1f1b10c
Instruction Fuzzy Hash: FA52E461D086948BF7218B24DC557EB7AB5EF91300F0480F9D48DA7282DA7E5FC58F62

Function 00B9B07E Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 494
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
W, xrefs: 00B9B46B
r, xrefs: 00B9C85B
o, xrefs: 00B9B425
a, xrefs: 00B9C82A
L, xrefs: 00B9B43A
b, xrefs: 00B9C846
x, xrefs: 00BAE219
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
L, xrefs: 00B9C838
y, xrefs: 00B9B464
E, xrefs: 00BAE212
L, xrefs: 00B9C81C
r, xrefs: 00B9B44F
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
i, xrefs: 00B9B441
W, xrefs: 00B9C869
d, xrefs: 00B9B433
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
a, xrefs: 00B9B42C
a, xrefs: 00B9C854
o, xrefs: 00B9C823
e, xrefs: 00BAE24A
r, xrefs: 00B9B45D
d, xrefs: 00B9C831
b, xrefs: 00B9B448
a, xrefs: 00B9B456
L, xrefs: 00B9B41E
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$jjjj$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-3844985698
Opcode ID: 61f2c59deee815be41dc54d5ef888de7f4ab37e735f9315a1cb375e12acf76e9
Instruction ID: 209119a1e6d154a12b016d5470b0a95380b4d75123d22c5b215d00446040598f
Opcode Fuzzy Hash: 61f2c59deee815be41dc54d5ef888de7f4ab37e735f9315a1cb375e12acf76e9
Instruction Fuzzy Hash: CB12F7A2D082688EEB208724DC58BFABAB5EF55300F1440F9D54CA7681D3BD4EC58F66

Function 00B9B036 Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
W, xrefs: 00B9B46B
r, xrefs: 00B9C85B
o, xrefs: 00B9B425
a, xrefs: 00B9C82A
L, xrefs: 00B9B43A
b, xrefs: 00B9C846
x, xrefs: 00BAE219
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
L, xrefs: 00B9C838
y, xrefs: 00B9B464
E, xrefs: 00BAE212
L, xrefs: 00B9C81C
r, xrefs: 00B9B44F
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
i, xrefs: 00B9B441
W, xrefs: 00B9C869
d, xrefs: 00B9B433
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
a, xrefs: 00B9B42C
a, xrefs: 00B9C854
o, xrefs: 00B9C823
e, xrefs: 00BAE24A
r, xrefs: 00B9B45D
d, xrefs: 00B9C831
b, xrefs: 00B9B448
a, xrefs: 00B9B456
L, xrefs: 00B9B41E
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$jjjj$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-3844985698
Opcode ID: 1d19c88a516d2c92f7ac5249116dd580f30c93b9dbb1f9de1026507b429096eb
Instruction ID: 4f2bbf428234b548f0d57638d990e216118d6bda8d25d2f5d12dbce32ef784ad
Opcode Fuzzy Hash: 1d19c88a516d2c92f7ac5249116dd580f30c93b9dbb1f9de1026507b429096eb
Instruction Fuzzy Hash: 2A0206A1D082A88EFB208624DC58BEABAB5EF51300F1440FED54D67681D3BD4EC58F62

Function 00B9B28E Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
W, xrefs: 00B9B46B
r, xrefs: 00B9C85B
o, xrefs: 00B9B425
a, xrefs: 00B9C82A
L, xrefs: 00B9B43A
b, xrefs: 00B9C846
x, xrefs: 00BAE219
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
L, xrefs: 00B9C838
y, xrefs: 00B9B464
E, xrefs: 00BAE212
L, xrefs: 00B9C81C
r, xrefs: 00B9B44F
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
i, xrefs: 00B9B441
W, xrefs: 00B9C869
d, xrefs: 00B9B433
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
a, xrefs: 00B9B42C
a, xrefs: 00B9C854
o, xrefs: 00B9C823
e, xrefs: 00BAE24A
r, xrefs: 00B9B45D
d, xrefs: 00B9C831
b, xrefs: 00B9B448
a, xrefs: 00B9B456
L, xrefs: 00B9B41E
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$jjjj$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-3844985698
Opcode ID: b537fcd964b153493a00b7e03931fad3a8f0c69a8d2ffcb94c3604bfe863e8a8
Instruction ID: 5f88baf32e53b044b2b495341f7668800dad5ed2158362d23b7ece24bf6e63fe
Opcode Fuzzy Hash: b537fcd964b153493a00b7e03931fad3a8f0c69a8d2ffcb94c3604bfe863e8a8
Instruction Fuzzy Hash: E60217A1D082A8DEFB248624DC58BEABAB5EF51300F1400FDD54C67681D3BE4EC58F66

Function 00B9B40E Relevance: 65.1, APIs: 1, Strings: 36, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
W, xrefs: 00B9B46B
r, xrefs: 00B9C85B
o, xrefs: 00B9B425
a, xrefs: 00B9C82A
L, xrefs: 00B9B43A
b, xrefs: 00B9C846
x, xrefs: 00BAE219
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
L, xrefs: 00B9C838
y, xrefs: 00B9B464
E, xrefs: 00BAE212
L, xrefs: 00B9C81C
r, xrefs: 00B9B44F
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
i, xrefs: 00B9B441
W, xrefs: 00B9C869
d, xrefs: 00B9B433
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
a, xrefs: 00B9B42C
a, xrefs: 00B9C854
o, xrefs: 00B9C823
e, xrefs: 00BAE24A
r, xrefs: 00B9B45D
d, xrefs: 00B9C831
b, xrefs: 00B9B448
a, xrefs: 00B9B456
L, xrefs: 00B9B41E
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$jjjj$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-3844985698
Opcode ID: b16931f06902280c7678b97d84559a7cb78fd260e16f1883994c2a081d6cf992
Instruction ID: 2b217c67b5491594e4bcc956e3792f9bd8335f42502ccd1993945f782f8d6b66
Opcode Fuzzy Hash: b16931f06902280c7678b97d84559a7cb78fd260e16f1883994c2a081d6cf992
Instruction Fuzzy Hash: A4E108A1D082A4DEFB258624DC58BFABAB5EF51300F1440F9D54D67682D3BD4EC58F22

Function 00B9B75C Relevance: 44.4, APIs: 1, Strings: 24, Instructions: 632
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: a955705c932bee563453179bf776a9b4eb512c8cdbadd2289de27f92fee82bb9
Instruction ID: dfcb3673cefdf9acfc862cdc1768ddac2c73e2d8eab80aa65eb785b2ea2bbc1a
Opcode Fuzzy Hash: a955705c932bee563453179bf776a9b4eb512c8cdbadd2289de27f92fee82bb9
Instruction Fuzzy Hash: 5542FCB1D082688BEB24CB24DD98BEABBB5EF44300F1441FAD80DA6681D7795EC5CF51

Function 00BD0397 Relevance: 44.3, APIs: 2, Strings: 23, Instructions: 561
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,3A42A905,00003000,00000004), ref: 00BD0F4F

Part of subcall function 00BD13CF: ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD2347

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD13FC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
L, xrefs: 00BD1403
r, xrefs: 00BDC3C8
a, xrefs: 00BD13F5
a, xrefs: 00BD141F
y, xrefs: 00BD142D
W, xrefs: 00BD1434
c, xrefs: 00BDC3D6
b, xrefs: 00BD1411
t, xrefs: 00BDC3BA
r, xrefs: 00BD1418
o, xrefs: 00BD13EE
i, xrefs: 00BD140A
L, xrefs: 00BD13E7
r, xrefs: 00BD1426
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocFileReadVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 237865483-215400123
Opcode ID: 4e43dbd6b27c65f5c0b81463dc53f3ba2ff4e29d4b54b8429dea4a72f46de544
Instruction ID: 5db15698012f0c64411d5d996cca7ad7f3a2bf0377fff55a6475448cd9753639
Opcode Fuzzy Hash: 4e43dbd6b27c65f5c0b81463dc53f3ba2ff4e29d4b54b8429dea4a72f46de544
Instruction Fuzzy Hash: E932CFB1D046A88FEB208B14DC84BEABBB5FB85304F1481EAD44D67381EA795EC5CF51

Function 00B9B524 Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: 6cb4255673c9041bdb9126c3b44322773cd03045a439dc6104c9148d406d3414
Instruction ID: 0c4d2a1ced0dd61c287b98bc4fef9deb0893d7e248f754e8e405d365859fc20b
Opcode Fuzzy Hash: 6cb4255673c9041bdb9126c3b44322773cd03045a439dc6104c9148d406d3414
Instruction Fuzzy Hash: B8F1F6B2D082649AFB208A24DC58BEABBB5EF55300F1440FAD50D67681D7BD4EC5CF62

Function 00B9BC8E Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: 1552af9edc850e6aa80d4d5839594a007459f4aa3c5030c7fcbbd2fa4a128418
Instruction ID: 32f18db43e3473c3b1d8a9589c22038dca134a5569596b2025b5ca803ef07919
Opcode Fuzzy Hash: 1552af9edc850e6aa80d4d5839594a007459f4aa3c5030c7fcbbd2fa4a128418
Instruction Fuzzy Hash: C5E1E5B2D082689EFB208A24DC58BEABBB5EF55300F1440FAD50D67281D77D5EC58F62

Function 00B9B4B3 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: b1d1bf0362d1718a0602441bd6b06b18ad4ea97a46cfdc46de974f78c3585bbe
Instruction ID: 98806e830ec0c9cea7981573c89f334503d5baf5fd01f984f390ff7f1c794803
Opcode Fuzzy Hash: b1d1bf0362d1718a0602441bd6b06b18ad4ea97a46cfdc46de974f78c3585bbe
Instruction Fuzzy Hash: DFD107A2D082549EFB208624DC58BF6BBB5EF51300F1440FAD50D6B681D7BD4EC58F22

Function 00B9BBC0 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: b30008775ab348093b09c1baae2af5d6630ff02e89fe9e8064871039ce89a68d
Instruction ID: b6f4dedde939127ba0b1f7d3077e67c075aacab49dcfadaeca42688de68c9d1e
Opcode Fuzzy Hash: b30008775ab348093b09c1baae2af5d6630ff02e89fe9e8064871039ce89a68d
Instruction Fuzzy Hash: C5D149A2D082649AFB208624DC58BFABAB5EF91300F1440FED50D67681D7BD5FC58F62

Function 00B9BBA7 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 336COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: ccc3df1db9ad571f49c48dc25df4c5fa9c5fa042fd90d664cbdc78868dde2002
Instruction ID: 4086fabe3b51cf57f2442c0cf8b7f3802efb43db3da864e6736de71a389b785d
Opcode Fuzzy Hash: ccc3df1db9ad571f49c48dc25df4c5fa9c5fa042fd90d664cbdc78868dde2002
Instruction Fuzzy Hash: A8D128A2D082649AFB208624DC58BFABAB5EF51300F1440FDD50D6B681D7BD5FC58F62

Function 00B9B72D Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 326COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: 644c071ce92036c26e74a7ac17c9ce4893cef1cc991b8b56fb563969ecb86e65
Instruction ID: 506b96de6fac724c9d860afc8b78a1308864659d739deebec9ac0321094bd6fd
Opcode Fuzzy Hash: 644c071ce92036c26e74a7ac17c9ce4893cef1cc991b8b56fb563969ecb86e65
Instruction Fuzzy Hash: F1D119A2D082649EFB208624DC58BFABBB5EF55300F1440FAD50D67681D7BD4EC58F22

Function 00BD0864 Relevance: 44.1, APIs: 2, Strings: 23, Instructions: 314COMMON

Download Yara Rule

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD13FC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
L, xrefs: 00BD1403
r, xrefs: 00BDC3C8
a, xrefs: 00BD13F5
a, xrefs: 00BD141F
y, xrefs: 00BD142D
W, xrefs: 00BD1434
c, xrefs: 00BDC3D6
b, xrefs: 00BD1411
t, xrefs: 00BDC3BA
r, xrefs: 00BD1418
o, xrefs: 00BD13EE
i, xrefs: 00BD140A
L, xrefs: 00BD13E7
r, xrefs: 00BD1426
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-215400123
Opcode ID: a5b3a4ea97d26bf110afadeb739ba28fdd42001d95d20abaa0ab866d9ebc9ef4
Instruction ID: 93c867274e8269c7d64fa176ac51d6226a38133384a52ba26843f13bfbd38931
Opcode Fuzzy Hash: a5b3a4ea97d26bf110afadeb739ba28fdd42001d95d20abaa0ab866d9ebc9ef4
Instruction Fuzzy Hash: A2C1F5A1D086A89EF7208B24DC48BEABBB5EF51304F1441FAD44D67381D6B95EC5CF22

Function 00B9B7F3 Relevance: 44.0, APIs: 1, Strings: 24, Instructions: 300COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: 37b6a9c8f1f080f88d1dbeaa63690d7e741f2d3cb871fbd3d1f2f6a05da0a74c
Instruction ID: 7f221be8dbee64ed5f9081dbcb0a3505984b53f05dc505863727bb4ba4e41a40
Opcode Fuzzy Hash: 37b6a9c8f1f080f88d1dbeaa63690d7e741f2d3cb871fbd3d1f2f6a05da0a74c
Instruction Fuzzy Hash: 21C118B2D082649AFB248624DC58BEABAB5EF51300F1440FDD50D6B681D3BD4FC58F62

Function 00B9B80A Relevance: 44.0, APIs: 1, Strings: 24, Instructions: 287COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
L, xrefs: 00B9C838
E, xrefs: 00BAE212
r, xrefs: 00B9C85B
L, xrefs: 00B9C81C
i, xrefs: 00B9C83F
P, xrefs: 00BAE22E
W, xrefs: 00B9C869
a, xrefs: 00B9C82A
o, xrefs: 00BAE23C
y, xrefs: 00B9C862
b, xrefs: 00B9C846
x, xrefs: 00BAE219
a, xrefs: 00B9C854
o, xrefs: 00B9C823
c, xrefs: 00BAE243
jjjj, xrefs: 00B9D792
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
d, xrefs: 00B9C831
i, xrefs: 00BAE220
r, xrefs: 00B9C84D
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$jjjj$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2409613264
Opcode ID: 1624732ce76d2bbc975d6d99aa8fd1d8d7467f9920638e2aea0028f12a4ce3c9
Instruction ID: 593845cd8f08e7248ca397921e87aa77dc08e9c809a05d7b3bdb6452636d69bf
Opcode Fuzzy Hash: 1624732ce76d2bbc975d6d99aa8fd1d8d7467f9920638e2aea0028f12a4ce3c9
Instruction Fuzzy Hash: 09B115A2D08268DAFB208624DC58BFABAB5EF51300F1440F9D50D6B681D7BD4FC58F66

Function 00BD0812 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 252COMMON

Download Yara Rule

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD13FC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
L, xrefs: 00BD1403
r, xrefs: 00BDC3C8
a, xrefs: 00BD13F5
a, xrefs: 00BD141F
y, xrefs: 00BD142D
W, xrefs: 00BD1434
c, xrefs: 00BDC3D6
b, xrefs: 00BD1411
t, xrefs: 00BDC3BA
r, xrefs: 00BD1418
o, xrefs: 00BD13EE
i, xrefs: 00BD140A
L, xrefs: 00BD13E7
r, xrefs: 00BD1426
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-215400123
Opcode ID: bef2b988d2dc49f916ebd63c5a52eda7999825fc022b76504528fc2f5968a508
Instruction ID: 05cba11a5e4703a955889f16cc9d3a7277c5cc3a168e855fe26ccbed4a49edcc
Opcode Fuzzy Hash: bef2b988d2dc49f916ebd63c5a52eda7999825fc022b76504528fc2f5968a508
Instruction Fuzzy Hash: B2A1D561D086A89AF7218724DC48BEABBB5EF51304F0440FAD44D67381D6B95FC9CB62

Function 00BD0822 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 247memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,3A42A905,00003000,00000004), ref: 00BD0F4F

Part of subcall function 00BD13CF: ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD2347

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD13FC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
L, xrefs: 00BD1403
r, xrefs: 00BDC3C8
a, xrefs: 00BD13F5
a, xrefs: 00BD141F
y, xrefs: 00BD142D
W, xrefs: 00BD1434
c, xrefs: 00BDC3D6
b, xrefs: 00BD1411
t, xrefs: 00BDC3BA
r, xrefs: 00BD1418
o, xrefs: 00BD13EE
i, xrefs: 00BD140A
L, xrefs: 00BD13E7
r, xrefs: 00BD1426
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocFileReadVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 237865483-215400123
Opcode ID: b7e23bcd465d0aecb345dd5b5048e5f5f8ed1b9cdbd160b243fe28a291a461c9
Instruction ID: 1b61afd8756fbf0a99f8c90e2bcf68f7f07d4113b437f733b195d16616edf3ae
Opcode Fuzzy Hash: b7e23bcd465d0aecb345dd5b5048e5f5f8ed1b9cdbd160b243fe28a291a461c9
Instruction Fuzzy Hash: 60A1D361D086A89AF7218724DC48BEABBB5EF51304F0441FAD44D67381E6BD1FC9CB62

Function 00BA9965 Relevance: 42.6, APIs: 1, Strings: 23, Instructions: 615injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

r, xrefs: 00BAE235
y, xrefs: 00BAE748
E, xrefs: 00BAE212
o, xrefs: 00BAE709
i, xrefs: 00BAE725
P, xrefs: 00BAE22E
r, xrefs: 00BAE741
o, xrefs: 00BAE23C
x, xrefs: 00BAE219
W, xrefs: 00BAE74F
a, xrefs: 00BAE73A
d, xrefs: 00BAE717
r, xrefs: 00BAE733
b, xrefs: 00BAE72C
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
L, xrefs: 00BAE702
a, xrefs: 00BAE710
i, xrefs: 00BAE220
L, xrefs: 00BAE71E
s, xrefs: 00BAE258

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 3559483778-215400123
Opcode ID: ac7b9e1dd04f70e7de0b177072d7c5c1231953ed825f591df7723d59efe9a286
Instruction ID: 622054e4146ff06357088f67577fe8b6669db11c2a81227519100710977f5453
Opcode Fuzzy Hash: ac7b9e1dd04f70e7de0b177072d7c5c1231953ed825f591df7723d59efe9a286
Instruction Fuzzy Hash: 5F42D1B1D082A88FEB24CB14CC94BEABBB5EF96304F1480EAD44D67241D6795EC5CF52

Function 00BD13CF Relevance: 42.2, APIs: 1, Strings: 23, Instructions: 188fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD2347

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD13FC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
L, xrefs: 00BD1403
r, xrefs: 00BDC3C8
a, xrefs: 00BD13F5
a, xrefs: 00BD141F
y, xrefs: 00BD142D
W, xrefs: 00BD1434
c, xrefs: 00BDC3D6
b, xrefs: 00BD1411
t, xrefs: 00BDC3BA
r, xrefs: 00BD1418
o, xrefs: 00BD13EE
i, xrefs: 00BD140A
L, xrefs: 00BD13E7
r, xrefs: 00BD1426
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 2738559852-215400123
Opcode ID: 556b3ff86fe89e113bb16b7b91bd09e4747050efe2e7354151b6677a10626095
Instruction ID: 04121c965262698d551889e24070c44690291aa2d0cdffc4fe56833792b16469
Opcode Fuzzy Hash: 556b3ff86fe89e113bb16b7b91bd09e4747050efe2e7354151b6677a10626095
Instruction Fuzzy Hash: 6171D961D082E89EF721C728DC44BD6BBB5AB51304F1441EAD44D27382D6B95EC9CF62

Function 0052D1BE Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 428COMMON

Download Yara Rule

Strings

d, xrefs: 0052D317
r, xrefs: 0052D333
y, xrefs: 0052D348
i, xrefs: 0052D325
o, xrefs: 0052D309
I2LO, xrefs: 0052D699
a, xrefs: 0052D310
b, xrefs: 0052D32C
r, xrefs: 0052D341
L, xrefs: 0052D302
W, xrefs: 0052D34F
L, xrefs: 0052D31E
a, xrefs: 0052D33A

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: I2LO$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-729522320
Opcode ID: a297e93832b9d92a693bcf59364f14390a921d24705a819d180a0f666cab83a8
Instruction ID: 06e209bfab370ea93eea89b08834a92b22bc362c6d1482d45046999ecc2ca926
Opcode Fuzzy Hash: a297e93832b9d92a693bcf59364f14390a921d24705a819d180a0f666cab83a8
Instruction Fuzzy Hash: 35F1F3B1D041698AE7248B24DC54BFABB75EF45300F1480FAD84DA7681EA795FC1CF62

Function 00BD77A4 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 323fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

x, xrefs: 00BDC3AC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
8OCG, xrefs: 00BD796C
c, xrefs: 00BDC3D6
t, xrefs: 00BDC3BA
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
:FF>, xrefs: 00BD7F7F
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: 8OCG$:FF>$E$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-3885756802
Opcode ID: 3c5fcd9b370aad73c09409a9f28899a26af6ce113b1ef107729b025b0b7089c0
Instruction ID: 17da6a01b358c9b5a6cfa0e971d616c5d9224c7a088f016e8703ddaf5b465c43
Opcode Fuzzy Hash: 3c5fcd9b370aad73c09409a9f28899a26af6ce113b1ef107729b025b0b7089c0
Instruction Fuzzy Hash: CED1AE71D486A89FEB24CB14CC94FEABBB5EB45304F1441EAD80D67381EA786EC48F51

Function 00525992 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 177nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

a, xrefs: 005259AC
o, xrefs: 005259A5
d, xrefs: 005259B3
i, xrefs: 005259C1
y, xrefs: 005259E4
L, xrefs: 005259BA
r, xrefs: 005259CF
r, xrefs: 005259DD
a, xrefs: 005259D6
L, xrefs: 0052599E
W, xrefs: 005259EB
J:5M, xrefs: 00526A4D
b, xrefs: 005259C8

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 2949231068-673730721
Opcode ID: 96bec22eb667e850d1caee0aa7b322d466be8adb9c4e5b9b753246c34e60d861
Instruction ID: e21ab6d8887930f35574b1bb7ecaffa7f61d8b7a13d00db245efa3f4d0020815
Opcode Fuzzy Hash: 96bec22eb667e850d1caee0aa7b322d466be8adb9c4e5b9b753246c34e60d861
Instruction Fuzzy Hash: 9661E571C052A89AF7208A14DC54BEABF75FF52314F1480FAD889662C1EB794ED4CF62

Function 00524284 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 341COMMON

Download Yara Rule

Strings

d, xrefs: 005243F3
a, xrefs: 00524416
y, xrefs: 00524424
L, xrefs: 005243DE
a, xrefs: 005243EC
L, xrefs: 005243FA
o, xrefs: 005243E5
r, xrefs: 0052440F
b, xrefs: 00524408
W, xrefs: 0052442B
i, xrefs: 00524401
r, xrefs: 0052441D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: ce20caae0fe3089e5b0a503112c34127d61b14a73c128f2b5ca0bc33fa0e1e9e
Instruction ID: cd54046aeebe33853b55ed0a68189c75188b00ae70fd7e1f1cdc63ef0df8f9ae
Opcode Fuzzy Hash: ce20caae0fe3089e5b0a503112c34127d61b14a73c128f2b5ca0bc33fa0e1e9e
Instruction Fuzzy Hash: E8D1EFB1D082688BE724CB25EC54BEABBB5FF91300F0081EAD54DA7281E3795EC58F11

Function 00B9CC48 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 338COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
jjjj, xrefs: 00B9D792
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$jjjj$o$r$s$s$t$x
API String ID: 0-1386992091
Opcode ID: 0a902f5c1408b8545fdc0f9d9fd53c1d9447d39ddbec3f6334b1fb6059fbf970
Instruction ID: fbc7f324cd846fc014f6832045922281977e8a9967d7e7f486a741ec4d2cfd54
Opcode Fuzzy Hash: 0a902f5c1408b8545fdc0f9d9fd53c1d9447d39ddbec3f6334b1fb6059fbf970
Instruction Fuzzy Hash: 37E18FB1D052688FEB24CB14CC94BAABBB5EB85314F1480FAD80D67282D6796FC5CF51

Function 00B9CA5D Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 318processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00B9D7A1

Strings

r, xrefs: 00BAE235
jjjj, xrefs: 00B9D792
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateProcess
String ID: E$P$c$e$i$jjjj$o$r$s$s$t$x
API String ID: 963392458-1386992091
Opcode ID: 280bc19c423a7e640761cc76966792d5b0a8201fa9e3dc9633a1fca7344f9024
Instruction ID: e8b5a5b34313dfa5f7402d6cda4bc45f129478eaa7b74d224bd292f9bab716ee
Opcode Fuzzy Hash: 280bc19c423a7e640761cc76966792d5b0a8201fa9e3dc9633a1fca7344f9024
Instruction Fuzzy Hash: 6BC106B2D042689EFB248B15DC55BEABBB9EB91300F1480F9D80DA6281D27C5FC5CF61

Function 00BD8C29 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 220registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
B9M8, xrefs: 00BD8BA4
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: B9M8$E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-799240736
Opcode ID: 95b98c603bfecc00f8172784ace10cfa0ea02d57fff0ba804b251cd215610f95
Instruction ID: 45e08fae2b31befeca8f7a3c712a00866b416dcac6951a2e941f1f00ba6f6aa3
Opcode Fuzzy Hash: 95b98c603bfecc00f8172784ace10cfa0ea02d57fff0ba804b251cd215610f95
Instruction Fuzzy Hash: D4815B71D092A98EF7218B24CC84BEABBF5EF42305F1440FBD48D56381EA755AC5CB62

Function 00BD633A Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 536fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD6EDE

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 3d0232c868a80c1802163b0f2457ed669f2a7483ee734c0904d8fffd84ae4218
Instruction ID: 250ab370b607cdda3c4ebcfe7bab5ead4c91efacfb1599daa84c45d728160325
Opcode Fuzzy Hash: 3d0232c868a80c1802163b0f2457ed669f2a7483ee734c0904d8fffd84ae4218
Instruction Fuzzy Hash: B322BCB1D046688BEB20CB14DC94BEAB7B5EB84315F1481EBD80DA7381E6399EC5CF51

Function 00BAD631 Relevance: 21.4, APIs: 1, Strings: 11, Instructions: 400COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateThread
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2422867632-3128998556
Opcode ID: cd3c0b831e1636af3114c68bb041c66c9ccc61c54e4bdfd1edc6aad19f81588d
Instruction ID: 5bbb413828ea9b8814e1f96c14670a2ed435341eff8c28e2e718fd40ea02cff4
Opcode Fuzzy Hash: cd3c0b831e1636af3114c68bb041c66c9ccc61c54e4bdfd1edc6aad19f81588d
Instruction Fuzzy Hash: 78F1E3B1D081A49BEB24CB24CC94BAABBB5EB86304F1441EAD40E67681D7799FC1CF51

Function 00BD6ACC Relevance: 21.4, APIs: 1, Strings: 11, Instructions: 353fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD6EDE

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 89837b4bd2ee1b2527c93c2169ae66c5c945e5705241e534e104aad63b48aec1
Instruction ID: 07e30941303bcd3972d1abe456c16431e57c4a9e6fe93a1090e7e84b3dddcf15
Opcode Fuzzy Hash: 89837b4bd2ee1b2527c93c2169ae66c5c945e5705241e534e104aad63b48aec1
Instruction Fuzzy Hash: 28F17DB1E046698FEB24CB18DC94BEAB7B1EB85301F1481EAD80DA7341E6795EC1CF51

Function 00BADE5D Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 320nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BAE20C

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateThread
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2422867632-3128998556
Opcode ID: 518b25b670a27d1fcb757b2c3a35b2ba8c0cb808419738516fdafb8143ffa7b7
Instruction ID: 55dfa42b0cc6a2a887c02b61194b852b29d84ae6ff8b767d75209dbcc9f616eb
Opcode Fuzzy Hash: 518b25b670a27d1fcb757b2c3a35b2ba8c0cb808419738516fdafb8143ffa7b7
Instruction Fuzzy Hash: DAE16EB1D086688FDB24CB14CC94BAABBB5FB85304F1481EAD819A7281D7799FC5CF50

Function 00BD8E14 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 314registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: fddfbca02205b6c6e91d1394d45e7f250aea5e2fe26a79e2186b105d7108301b
Instruction ID: 075078aa445257a9513aff142ae798caceaa739fbaf8dabb1c2b6a0a1922af3e
Opcode Fuzzy Hash: fddfbca02205b6c6e91d1394d45e7f250aea5e2fe26a79e2186b105d7108301b
Instruction Fuzzy Hash: B7D1AFB1E046A88FEB24CB14CC94BEABBB1EB86305F1441EAD84D66381D7755EC1CF52

Function 00BD181A Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 281COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: 1db86358f3c5564da507bf57ebce829efd95c012ba7584a747c637bfd89cc6b0
Instruction ID: 65741c1d9d948bedf8d73a9e574905cb347820c1b3e1888b376a7f311ed6c2ae
Opcode Fuzzy Hash: 1db86358f3c5564da507bf57ebce829efd95c012ba7584a747c637bfd89cc6b0
Instruction Fuzzy Hash: 7CC17BB0D046A99FEB24CB18CC94BAABBB1FB84304F1485EBD44966381EA345EC5CF51

Function 00BD1621 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 270COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: a5bf856ca8ac623e081bbbb2f63431a23c32e98d837d255305efd5d7cfef2a9d
Instruction ID: b0022f8f6d773df23c1fbbb3a2c9234b90963171301fd5bb0162404bc931cb9c
Opcode Fuzzy Hash: a5bf856ca8ac623e081bbbb2f63431a23c32e98d837d255305efd5d7cfef2a9d
Instruction Fuzzy Hash: 99A158B1D082A89EE7208B24CC44BEABBB5FF55304F0442EBE44D66381E6795EC4CF11

Function 00BAE15A Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BAE20C

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateThread
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2422867632-3128998556
Opcode ID: e678f47ca8600150e722c2c2b5720145ce60e5f60e8152c0bcd91cce3ed0b0d8
Instruction ID: 6e02f36a4fb3a0ea6572de06e4faf378f974afe984fcef5c49d945129d97850b
Opcode Fuzzy Hash: e678f47ca8600150e722c2c2b5720145ce60e5f60e8152c0bcd91cce3ed0b0d8
Instruction Fuzzy Hash: E541E271D086A88EEB25CB14CC94BEABBB5AB91300F1444E9D41D67281D7BD9BC5CF11

Function 00BAD677 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 94nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BAE20C

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateThread
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2422867632-3128998556
Opcode ID: 27277a7418e1acdaccec4ed85f76329491613a59a0177e9bb63f32233a52ae2c
Instruction ID: 991eccc2cb43e663f97b4d4384d0049a0d0b59c6e565c8e74c41d6668583e958
Opcode Fuzzy Hash: 27277a7418e1acdaccec4ed85f76329491613a59a0177e9bb63f32233a52ae2c
Instruction Fuzzy Hash: 1A3105B2D0C5E49EF7258614CC58BAABBB9DB91300F1444FDD41D67282C6BD9BC58F21

Function 00BADABC Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 91nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BAE20C

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateThread
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2422867632-3128998556
Opcode ID: 91f9c06b7137ecf195aadce7c818b31bcd9f632155a405a53eee909cda8a0efa
Instruction ID: eb63081841ebe5f15630282da88fb60b4dda9334032c75b76927aa83d38c5976
Opcode Fuzzy Hash: 91f9c06b7137ecf195aadce7c818b31bcd9f632155a405a53eee909cda8a0efa
Instruction Fuzzy Hash: 9631F6B2D0C5A4DEF7258614CC58BAABBB9DB91300F1444FDD41D67282C6BD9BC48F21

Function 00BA0D05 Relevance: 15.2, Strings: 12, Instructions: 169COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
_P, xrefs: 00BA1094
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$_P$c$e$i$o$r$s$s$t$x
API String ID: 0-226139956
Opcode ID: 42bb12ce68937487845459e9f8eb0f122e2e8def7df84a9366bc2b6eefb02a72
Instruction ID: 456b97d1723aa485fc8b5c4e9416eaec4b5e7c2c938b3777fc23788678bd5173
Opcode Fuzzy Hash: 42bb12ce68937487845459e9f8eb0f122e2e8def7df84a9366bc2b6eefb02a72
Instruction Fuzzy Hash: 5F6113B2D082A49AEB248A24CC58BDB7BB4EB95310F1444FAD90D67281D67C9BC58F61

Function 00BAC1CD Relevance: 14.1, Strings: 11, Instructions: 328COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: c2eeba3f2eb29bf3836f3c83f76e6b35edfc1614368ea74cd51e50accfb833bb
Instruction ID: 2998a20b6d072a665f8fd8d91c4fb7226f6b7eef6df6a389a2d9abca3cff5cc5
Opcode Fuzzy Hash: c2eeba3f2eb29bf3836f3c83f76e6b35edfc1614368ea74cd51e50accfb833bb
Instruction Fuzzy Hash: 7EC123B2D081689EF7248A14DC45BEB7BB8EB91304F1440FAD80DA6281E7B95FC58F52

Function 00BAC8D5 Relevance: 14.0, Strings: 11, Instructions: 263COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: a27fa2d60a6c43845c91d1e8ad43a9861c6726e384421892488baaedf94f3996
Instruction ID: 4cd5eb3f7fabe44df33c96fb09a9d325c9ff0aa1c225a18c566ff92c3aff4d0a
Opcode Fuzzy Hash: a27fa2d60a6c43845c91d1e8ad43a9861c6726e384421892488baaedf94f3996
Instruction Fuzzy Hash: B6B1A2B2D081699EEB248B24DC94BEABBB5EF95304F1440FAD44DA7281E7785FC48F11

Function 00BAC734 Relevance: 14.0, Strings: 11, Instructions: 256COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: 8cd91fe9d4fbebbc51b4128df5c47df37da463f39a48d196ca783e7473a2558a
Instruction ID: f3fcb796bc49396945cea051c3ebc51734b263e849c0660b31a4a9fba8e5770e
Opcode Fuzzy Hash: 8cd91fe9d4fbebbc51b4128df5c47df37da463f39a48d196ca783e7473a2558a
Instruction Fuzzy Hash: 10A1BFB2D081689EEB248A24DC94BEBBBB5EF95310F1540FAD40D67281E7785EC48F51

Function 00524DB7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 177nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Strings

8B@?, xrefs: 00524D99
NJNG, xrefs: 00524F3D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: 8B@?$NJNG
API String ID: 2949231068-498756497
Opcode ID: f0d20a1b57f7bfce199b38bf090cb1343863960274a5209b45cb497694ed7560
Instruction ID: a8d140b6c44db177d5d11e5c8b97ed15adb84c6eb138bc56e0c3dcec9b219a56
Opcode Fuzzy Hash: f0d20a1b57f7bfce199b38bf090cb1343863960274a5209b45cb497694ed7560
Instruction Fuzzy Hash: 7071CEB1D052788BEB208F61DC547EABBB5FF81301F1444EAD949A6281E7745EC1CF12

Function 00525DB1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: f72eee23a806f388ee9292c86d773b295e05654a88184713ef1afb1e8727049c
Instruction ID: c8e57a9f141d34b8b03ac10eeb405ed14b568353c2a55f1cfa8360ae1207a038
Opcode Fuzzy Hash: f72eee23a806f388ee9292c86d773b295e05654a88184713ef1afb1e8727049c
Instruction Fuzzy Hash: 74F17FB1D045288BEB24CA14EC94BEABBB5FF86311F1481EAD90D66280E7395FD1CF51

Function 00524F44 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 382nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Strings

8B@?, xrefs: 00524D99

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: 8B@?
API String ID: 2949231068-567948484
Opcode ID: 0426e4b02380791d3ec1e9f233ad5d0dabeeb45b9d9b7fd61ab4aeeabecee3d0
Instruction ID: fdf4e88136c85d5ff65a6922f9e1b92aa28d1614929327122a6e251c39d5124f
Opcode Fuzzy Hash: 0426e4b02380791d3ec1e9f233ad5d0dabeeb45b9d9b7fd61ab4aeeabecee3d0
Instruction Fuzzy Hash: 8DF1AAB1D042688BEB24CB20DC90BEABBB5FF85300F1441EAD84DA7281E7355ED18F52

Function 005256BC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: J:5M
API String ID: 0-1447950488
Opcode ID: cde54c13cccd4bd4c331ee66c9fda6c9714edbc6a8cc8bc8dc22bc32b707be62
Instruction ID: c7e5fe0b7428a849d60daa00a954045d7e009450adb6905330eee5166e82a1aa
Opcode Fuzzy Hash: cde54c13cccd4bd4c331ee66c9fda6c9714edbc6a8cc8bc8dc22bc32b707be62
Instruction Fuzzy Hash: 39D1D0B2D146289AEB248B14EC54BEAB775FF95310F1441FAD80DA6280E7795FC0CF62

Function 00BC9F84 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

W, xrefs: 00BCA3F9

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-3182507374
Opcode ID: 4abf9358ba45ffc95ab60c1bb561a83c3c7a2cf4a8171d020db124f303fb13a7
Instruction ID: c5c57a9f169ca82c7063124888084001d86519b3d383588dded4b00040c8c4dd
Opcode Fuzzy Hash: 4abf9358ba45ffc95ab60c1bb561a83c3c7a2cf4a8171d020db124f303fb13a7
Instruction Fuzzy Hash: 46C16FB1E0016D8FEB24CF14CC94FAAB7B5EB85318F1481EAD94AA6640D7349EC1CF52

Function 005264C0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 279nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: d36030e6f0c51e507fa633b7a57c28760d8616b82856a78580c029888ddf3fc9
Instruction ID: ac6af936b3191bec4b864506dffb6f0bdf899ec21b7a0ee32f782e0655db6c87
Opcode Fuzzy Hash: d36030e6f0c51e507fa633b7a57c28760d8616b82856a78580c029888ddf3fc9
Instruction Fuzzy Hash: 8DC148B5D046388BEB24CB14EC90AEABBB5FF85305F1481EAD80DA7681E7355E80CF55

Function 00B76018 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-2161188062
Opcode ID: 97d2ab42c8037978237ee316d1cfcb6983db3100050b4ba86dfa3bae16191d96
Instruction ID: f59a2dbcfcb97c97ff238ab37df66789a07a1e28b38da7ded7fe16a2ce08d522
Opcode Fuzzy Hash: 97d2ab42c8037978237ee316d1cfcb6983db3100050b4ba86dfa3bae16191d96
Instruction Fuzzy Hash: 029137B2D046649FE7208A14DC84BFB7BB9EF85310F1480FAD95DA6601D2389FC5CE51

Function 00525BCC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 253nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: 5f67d16627df8ecbe0bfeb1fdf5568d9eb6e311f44af0672d94808fb17b0cfce
Instruction ID: 68c20022282816b22831a42ed3ccd44f20702ebefd2366cf9f95c0dc24e321ab
Opcode Fuzzy Hash: 5f67d16627df8ecbe0bfeb1fdf5568d9eb6e311f44af0672d94808fb17b0cfce
Instruction Fuzzy Hash: 8CA1B3B1D056789AE7208B14EC94BEABB75FF86311F1480FAD84D66281E7385EC4CF52

Function 00B76551 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,00B76550,?,?,?,?,?,?), ref: 00B7696A

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: 47eb72316b0503c3834ba21bcfb694f9141e91805cf627b0f6da5ebaab2c2d97
Instruction ID: 873709ae03cdfef0b0ac8b89d7ef6886d121151bd2fea0a8d319b6cc97fc38de
Opcode Fuzzy Hash: 47eb72316b0503c3834ba21bcfb694f9141e91805cf627b0f6da5ebaab2c2d97
Instruction Fuzzy Hash: 0A81ADB2C055289FE7248B10DD95BEBB7B9EB94310F0081FAD90EA6241E2396FC1CF51

Function 005264F8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 221nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: bbde08724088bc74882cf31dfb48bc9a4f7a9bd93be8908d02aca250b8bf6032
Instruction ID: 40f7c85247280dbe655c54fec4129e55dc7d5b5ed1956c5b1bbfdb2633db6c53
Opcode Fuzzy Hash: bbde08724088bc74882cf31dfb48bc9a4f7a9bd93be8908d02aca250b8bf6032
Instruction Fuzzy Hash: 1A81B3B1D042689AEB248B14EC51BEABB75FF45310F1044FAD80DA7280E7795EC0CF56

Function 00525FAB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 210nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: 3339fdf80e0c318d076cd26b7a17c2efda41ac1322f20dcc6affd97aaef21a00
Instruction ID: 475e8a67fe790cef8469a52f0e382227d2c40f6e07f7adb8d2805fe97f1c13cd
Opcode Fuzzy Hash: 3339fdf80e0c318d076cd26b7a17c2efda41ac1322f20dcc6affd97aaef21a00
Instruction Fuzzy Hash: 867104B1D045749AEB248A14EC90BFFBB75FF86301F2480FAD94966281E7395ED0CE52

Function 00525AAB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: 513d9b404fd50bc24eb74f91067ae9953ed49f2b9c9e25615959e366632e64cd
Instruction ID: e6821f87017ca1312d7d7939d02f7218f36276be8c9bd6a70bb906b405e7b1a7
Opcode Fuzzy Hash: 513d9b404fd50bc24eb74f91067ae9953ed49f2b9c9e25615959e366632e64cd
Instruction Fuzzy Hash: 8561E4B2D056689AF7209B24EC54AEBBB35EF86310F1444FAD84D66281E7344EC4CF62

Function 005262AE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: 66fc55f3a6d298892467544d42679157a9daa9f18538f96c853830b5aaa12241
Instruction ID: edd3d24a413b43b43ab967c05bc8b10b4732928ee41839f97e4e69196876678d
Opcode Fuzzy Hash: 66fc55f3a6d298892467544d42679157a9daa9f18538f96c853830b5aaa12241
Instruction Fuzzy Hash: 9851B2B1D146649AEB148B14EC51BFB7B75FF86310F1084FAD809A6280E7399EC0CF66

Function 00526806 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: eb5f69df7a9db660cdf98b0dfe7b8ae8ad8aca011eb7ae95cbbadb2e372d2143
Instruction ID: b80ab107cd0b13284112ce2637ef424940ae0555008f4273db799a43c8a1c214
Opcode Fuzzy Hash: eb5f69df7a9db660cdf98b0dfe7b8ae8ad8aca011eb7ae95cbbadb2e372d2143
Instruction Fuzzy Hash: 0A41A6B1D046649AEB248B14ECA1BFABBB5FF86311F1041FAD909662C0D7351FC0CE15

Function 00524CE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Strings

8B@?, xrefs: 00524D99

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: 8B@?
API String ID: 2949231068-567948484
Opcode ID: 8808c2c796b179c374d0541ad21badb3ea8d46622d7b1a1a5372dff9253ddc4f
Instruction ID: f7c917df65d211d597e5cdb0397b11a43f464b2f3131c68ee603e1764a30e275
Opcode Fuzzy Hash: 8808c2c796b179c374d0541ad21badb3ea8d46622d7b1a1a5372dff9253ddc4f
Instruction Fuzzy Hash: D941CDB2D056689FE724CB64DC50BEABBB5FF81300F0541EED8099B291E6385EC58F52

Function 00525D4F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: 611d7eeeed460c9a34d9193e647b93930fb7a432b42e0caba49d603e0586164e
Instruction ID: 303c141c7468276458a2c351efa1d55c1dd88b4fc4eb6e0d4b1f9e05822d7292
Opcode Fuzzy Hash: 611d7eeeed460c9a34d9193e647b93930fb7a432b42e0caba49d603e0586164e
Instruction Fuzzy Hash: FF3107B2C051749AF7505B10EC55BFB7B39EF82310F1444BAD809A62C0EA395EC0CE62

Function 00525D76 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 005268E9

Strings

J:5M, xrefs: 00526A4D

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: J:5M
API String ID: 2949231068-1447950488
Opcode ID: a86ea6f8b0f7201756c8355b8ef54853c9c39660f93843fc66a20de3b04c4a89
Instruction ID: 2cd2f5d52f4d413289afd1102b1a7b9138a44f77a43ead8f3fa7a891a6018c92
Opcode Fuzzy Hash: a86ea6f8b0f7201756c8355b8ef54853c9c39660f93843fc66a20de3b04c4a89
Instruction Fuzzy Hash: 5631E4B2D051349AF7505A04EC51BFB7B39EF82310F1480BAD80DA62C0EB395ED0DE62

Function 00B64B41 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

Strings

>>2P, xrefs: 00B656DE

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: >>2P
API String ID: 0-2573114769
Opcode ID: 78bfdcba4a27937e77173a10203d07d04738a863f8e7654ed40ea0af861e98e3
Instruction ID: 3f7cfc5fe1a352720a1b0549e8bce17618b776e917f264496a2edefe0c6bc398
Opcode Fuzzy Hash: 78bfdcba4a27937e77173a10203d07d04738a863f8e7654ed40ea0af861e98e3
Instruction Fuzzy Hash: 631279B1D056288FEB24CB14DC94BEABBB5FB84315F2482EAD80A67341D6785ED1CF40

Function 00524794 Relevance: 1.8, APIs: 1, Instructions: 318nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 0692adf96fadd26f70a31dc3807ab6b6dff03feeff83c8a899363b8a8264b22e
Instruction ID: aeab93d83b1d8fcac182298a6eda67281a3a75b32a90448af3a843c4a4dc6f4d
Opcode Fuzzy Hash: 0692adf96fadd26f70a31dc3807ab6b6dff03feeff83c8a899363b8a8264b22e
Instruction Fuzzy Hash: B9D158B1E046688FEB24CB14DC94BEABBB6FF85300F1441EAD849A7281D7785ED1CE51

Function 0052C44C Relevance: 1.7, APIs: 1, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7971977b634f151d6536a0b0ff6de702562754ec94f8309096cb4df65ff96db3
Instruction ID: 4480a6a641ab9ceab97adfa6f3729ad2968e0f95529e4a68193ea7ad5f729df2
Opcode Fuzzy Hash: 7971977b634f151d6536a0b0ff6de702562754ec94f8309096cb4df65ff96db3
Instruction Fuzzy Hash: 3361AFB1D002298BEB248B14DC90BFB7B74FF55310F1485F9D84966681E7385EC5CB92

Function 0052C35B Relevance: 1.7, APIs: 1, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d45282f72b934b338573290c4c81dc00809ffe1f547e1bb502ba066196d577ad
Instruction ID: 5f076508124aa2acac0b9d78ca95abbdc0a8ebbe8a9c77c4934d9e60e4abff90
Opcode Fuzzy Hash: d45282f72b934b338573290c4c81dc00809ffe1f547e1bb502ba066196d577ad
Instruction Fuzzy Hash: 2A51A3B1D0413A8AEB248B10DC94BFEBB78FF55310F5445E9E849A6281E7385EC1DB51

Function 00524A6F Relevance: 1.6, APIs: 1, Instructions: 130nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 6b8f1653e2e9f1227ab2d5a70310f3e084080a0898a3358da9a785c586ad5107
Instruction ID: bbf1f7d68d506219ec8e7c5cd9b60a561aa4919eced7df5a070335fe0606c4a5
Opcode Fuzzy Hash: 6b8f1653e2e9f1227ab2d5a70310f3e084080a0898a3358da9a785c586ad5107
Instruction Fuzzy Hash: AD4101B2D055784FEB248A14DC54BEA7BB5BF92305F1401FAD88EA6181E3785EC0CE91

Function 00524A5E Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 105a66fe2dcf513f19aea5e265c2fa8ac759685f867e0a4fd42d72081c35a21f
Instruction ID: fe4c6e5e5364d3d7f3959e042b1fc133f809f63307d65980cba20bcf89475eb4
Opcode Fuzzy Hash: 105a66fe2dcf513f19aea5e265c2fa8ac759685f867e0a4fd42d72081c35a21f
Instruction Fuzzy Hash: F8410172D055748FEB20CB24DC54BEA7B75FF92301F1401EAD48AA6181E7785EC5CE51

Function 00BD337B Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 00BD39B1

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FolderKnownPath
String ID:
API String ID: 3622228125-0
Opcode ID: a98fd74657d494d7bc18e661e030dad5cc5fc71b2d21d18335cd81041a068741
Instruction ID: 43f6449c84806c39edaa68040092df0c087e77289607f8ed548b242889591c5d
Opcode Fuzzy Hash: a98fd74657d494d7bc18e661e030dad5cc5fc71b2d21d18335cd81041a068741
Instruction Fuzzy Hash: 08416676E192188BDB28DB39CC546AAB6B2FF94300F1095FED04DD7261E7314BC98B15

Function 0052522E Relevance: 1.6, APIs: 1, Instructions: 75nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 084d38972bf398dd5b967ca512c5b7332459f70b55faf3d96fe80e6ad8926101
Instruction ID: c21490952d30bec6cb3388e800f6938817f4c72a35a65f0a0b4ac6da8433f1e7
Opcode Fuzzy Hash: 084d38972bf398dd5b967ca512c5b7332459f70b55faf3d96fe80e6ad8926101
Instruction Fuzzy Hash: 5B31D471D05AA98FEB20CB64DCA07EABBB1BF52310F1405EAC449962C1E7756EC5CF01

Function 00524EF8 Relevance: 1.6, APIs: 1, Instructions: 71nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00525327

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: f4f4d64ca56e67e1c805e2745c6a31d59367d38405e6668aea5a91b17b535ac2
Instruction ID: 9740825ecc8f2b5d8f0e3e760d4935481abe5be863b9ecbfe7678f7fed7ddd99
Opcode Fuzzy Hash: f4f4d64ca56e67e1c805e2745c6a31d59367d38405e6668aea5a91b17b535ac2
Instruction Fuzzy Hash: 0621CEB1D055248FE724CFA0DD50BEABBB5FB50300F1441EED90A9A682E3385EC08F10

Function 0052CA3B Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

JE:C, xrefs: 0052CAF1

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: JE:C
API String ID: 0-1774249533
Opcode ID: 801387182d9ea3105ffa3eb4632e5bee7b38a4d7d391a8015f6272249f9c26b1
Instruction ID: c4a5362cca0b0ce3a4dcbc378a02870305fadac0281dd1d48746662f2b24221d
Opcode Fuzzy Hash: 801387182d9ea3105ffa3eb4632e5bee7b38a4d7d391a8015f6272249f9c26b1
Instruction Fuzzy Hash: 039137B2D041755FE3248A28EC94AFF7F75FF82310F1481FAD80E56685E6385EC58A92

Function 00BD805B Relevance: 45.8, APIs: 1, Strings: 25, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

x, xrefs: 00BDC3AC
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
e, xrefs: 00BD8519
c, xrefs: 00BDC3D6
y, xrefs: 00BD8551
x, xrefs: 00BD855F
s, xrefs: 00BDC3E4
W, xrefs: 00BD8566
g, xrefs: 00BD8520
i, xrefs: 00BDC3B3
p, xrefs: 00BD852E
O, xrefs: 00BD8527
R, xrefs: 00BD8512
e, xrefs: 00BD854A
n, xrefs: 00BD853C
o, xrefs: 00BDC3CF
K, xrefs: 00BD8543
r, xrefs: 00BDC3C8
E, xrefs: 00BD8558
t, xrefs: 00BDC3BA
E, xrefs: 00BDC3A5
e, xrefs: 00BD8535
e, xrefs: 00BDC3DD
OKFZ, xrefs: 00BD8152

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$E$K$O$OKFZ$P$R$W$c$e$e$e$e$g$i$n$o$p$r$s$s$t$x$x$y
API String ID: 3934441357-3184967104
Opcode ID: e553e6730a568a77e79c10c949239af044e7577e0e0762b0dec6d2e202367c43
Instruction ID: af5a112b5c903f969424789b30242ed75d0c435e48d2371d1a9069d7ee20aef6
Opcode Fuzzy Hash: e553e6730a568a77e79c10c949239af044e7577e0e0762b0dec6d2e202367c43
Instruction Fuzzy Hash: BBE18220E086A88AEB24CB24DC98BDEB771EF55305F1440EAC50CA7791D77A5FC58F16

Function 00BD95E5 Relevance: 45.8, APIs: 1, Strings: 25, Instructions: 306
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

x, xrefs: 00BDC3AC
W, xrefs: 00BD9ACD
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
a, xrefs: 00BD9AA3
S, xrefs: 00BD9A87
V, xrefs: 00BD9A9C
t, xrefs: 00BD9A95
g, xrefs: 00BD9A80
c, xrefs: 00BDC3D6
x, xrefs: 00BD9AC6
s, xrefs: 00BDC3E4
E, xrefs: 00BD9ABF
i, xrefs: 00BDC3B3
R, xrefs: 00BD9A72
e, xrefs: 00BD9A8E
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
e, xrefs: 00BD9A79
l, xrefs: 00BD9AAA
t, xrefs: 00BDC3BA
e, xrefs: 00BD9AB8
E, xrefs: 00BDC3A5
u, xrefs: 00BD9AB1
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$E$P$R$S$V$W$a$c$e$e$e$e$g$i$l$o$r$s$s$t$t$u$x$x
API String ID: 71445658-425225773
Opcode ID: 438c2c35faa5ce9e7c401b89336990fdd6440deb699904a00fd103c1a0134fcd
Instruction ID: 6f16d006e99aa60a7a41d1dbcec58fb5410d99cf56e553d8e7722f0f47089155
Opcode Fuzzy Hash: 438c2c35faa5ce9e7c401b89336990fdd6440deb699904a00fd103c1a0134fcd
Instruction Fuzzy Hash: 91E16F70E086A98AEB20CB14CC94BEABBB1EF56305F1481EAC44DA7781D7795EC1CF51

Function 00BD736E Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 144fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

x, xrefs: 00BDC3AC
d, xrefs: 00BD738D
r, xrefs: 00BD73B7
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
W, xrefs: 00BD73C5
a, xrefs: 00BD73B0
o, xrefs: 00BDC3CF
y, xrefs: 00BD73BE
a, xrefs: 00BD7386
r, xrefs: 00BDC3C8
b, xrefs: 00BD73A2
i, xrefs: 00BD739B
o, xrefs: 00BD737F
c, xrefs: 00BDC3D6
L, xrefs: 00BD7378
t, xrefs: 00BDC3BA
s, xrefs: 00BDC3E4
L, xrefs: 00BD7394
E, xrefs: 00BDC3A5
r, xrefs: 00BD73A9
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 3934441357-215400123
Opcode ID: 421c32f5b9068e6b2d7548e32166378fa5e3df317132f4d45a7b50fca4c9d530
Instruction ID: f6ee56c2ab2342e6a5f085959ac73e77e442b54348114b36fc72402dc08fb7e5
Opcode Fuzzy Hash: 421c32f5b9068e6b2d7548e32166378fa5e3df317132f4d45a7b50fca4c9d530
Instruction Fuzzy Hash: D4519761D0C6D88EF7218724DC48BDABFB5AB51304F1845EAD44C66382DAFA5EC4CF62

Function 00BD75AA Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 235fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
F7HK, xrefs: 00BD779F
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$F7HK$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-1436885376
Opcode ID: c695d39df44093c626dec41607b954d6adc1d15dca7c00918ea19f189914d242
Instruction ID: 5b04ab0b0a4619a3436f6889a2bc80136b9d343da8f4850283c054f9663ca097
Opcode Fuzzy Hash: c695d39df44093c626dec41607b954d6adc1d15dca7c00918ea19f189914d242
Instruction Fuzzy Hash: 5791E4B1D096648AF7248B24DC84BFAB7B5EB90314F1441FAE80D56381FA795FC4CB22

Function 00B9C96C Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 216COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
jjjj, xrefs: 00B9D792
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateProcess
String ID: E$P$c$e$i$jjjj$o$r$s$s$t$x
API String ID: 963392458-1386992091
Opcode ID: 43d93f5ace59385dc91f7021f7a8eae8f3033300cd2357f22eaa28b3847f1806
Instruction ID: a5c48333b2a81f4448d8f1cf0b081451dca03b5294fc36a04e830cfa6b179719
Opcode Fuzzy Hash: 43d93f5ace59385dc91f7021f7a8eae8f3033300cd2357f22eaa28b3847f1806
Instruction Fuzzy Hash: 328116B2D082689EFB248A15DC55BEABBB9EB91300F1480F9D40D66281D6BC5FC58F61

Function 00BA9DAF Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 211COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
KMLH, xrefs: 00BA9E2F
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$KMLH$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-2739336334
Opcode ID: 34b6332adda89b11cc09b3a8f1b54e8f64d65f2a1dd92fa3665bbd248c483b67
Instruction ID: a25924d6a434fb20868963437035d5d358bf059c200f1f3e0b144c0ba0d28670
Opcode Fuzzy Hash: 34b6332adda89b11cc09b3a8f1b54e8f64d65f2a1dd92fa3665bbd248c483b67
Instruction Fuzzy Hash: C77127B2D081A49EE7258614DC48BEB7BB8EB91310F1440FAD40D66242D67D9FC59F62

Function 00B9CFE2 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 204COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
jjjj, xrefs: 00B9D792
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$jjjj$o$r$s$s$t$x
API String ID: 0-1386992091
Opcode ID: 58ac242294884eb2a61a53ea674f79a933d55f89a216262de9f459e7f1fcd78f
Instruction ID: 47bfdf37943fd870a2fe02b81d1c93338e85486c4e7e5b4ccfcc9461f8cba591
Opcode Fuzzy Hash: 58ac242294884eb2a61a53ea674f79a933d55f89a216262de9f459e7f1fcd78f
Instruction Fuzzy Hash: B87109B1D082549EFB248A10CC59BEB7BB8EB51310F1440FAD90D67281D6BD5FC58F62

Function 00BD798B Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 186COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
8OCG, xrefs: 00BD796C
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: 8OCG$E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-2755600502
Opcode ID: d6c3a2827d849c7c02a287d1662375e864326d0d13a80b9bafa4cc1b5819fc19
Instruction ID: 203fce2c8edb97d3863129fb4795198d7a1ad029c4e0c642acd4506b9891b307
Opcode Fuzzy Hash: d6c3a2827d849c7c02a287d1662375e864326d0d13a80b9bafa4cc1b5819fc19
Instruction Fuzzy Hash: 0A712471D4C6A49AF7218714CC94FEEBBB5EB51305F0801EFD80D56281EA795EC48F21

Function 00BD814C Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 127COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD
OKFZ, xrefs: 00BD8152

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$OKFZ$P$c$e$i$o$r$s$s$t$x
API String ID: 0-532276410
Opcode ID: 385d7cc7dcb62ae4e92764442b9ceb0dc265a06186cdcbd0eb87a7e629b7f801
Instruction ID: f2083baeee6439b8f38576679dd104b98031522febce4cf783063d13466e8d8c
Opcode Fuzzy Hash: 385d7cc7dcb62ae4e92764442b9ceb0dc265a06186cdcbd0eb87a7e629b7f801
Instruction Fuzzy Hash: 8851B870D086E94AFB20CB24CC94BEEBBB5AF46305F1441EBC44D66382DA755E858F12

Function 00B9D036 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 100processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00B9D7A1

Strings

r, xrefs: 00BAE235
jjjj, xrefs: 00B9D792
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateProcess
String ID: E$P$c$e$i$jjjj$o$r$s$s$t$x
API String ID: 963392458-1386992091
Opcode ID: a8db38e2e8b2243e8d989bbad8d411b971e13a200e175328247b8db09075798e
Instruction ID: 076eaa4a399b06a0bb9a76fa1517dd92653216bcb02ae9bef7c7541741567158
Opcode Fuzzy Hash: a8db38e2e8b2243e8d989bbad8d411b971e13a200e175328247b8db09075798e
Instruction Fuzzy Hash: BA412AB2E0C2949DFB258624CC59BEA7BB99B91300F1444FDD51D3A2C1C6BD5BC49B21

Function 00BA9867 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 244COMMON

Download Yara Rule

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3128998556
Opcode ID: 16bfdc245e4746d616f924fb9306c3ca9efe60c7470560b6d579f954dd25aca3
Instruction ID: 33279238ca8bc56f0a13e1968a467946eaa97b82a5b69a31a1f05c83845934c3
Opcode Fuzzy Hash: 16bfdc245e4746d616f924fb9306c3ca9efe60c7470560b6d579f954dd25aca3
Instruction Fuzzy Hash: 4391C3B1D082649EEB248B14DC84BEA7BB5EF52310F1480EED40D66281D67C9FC5DF66

Function 00BDAEA4 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,?,00BDAE9C,?,?,?,?,?,?,?,?,?), ref: 00BDAF7B

Strings

d, xrefs: 00BDAFB9
l, xrefs: 00BDAF88
C, xrefs: 00BDAF81
e, xrefs: 00BDAFC7
a, xrefs: 00BDAFAB
H, xrefs: 00BDAFA4
o, xrefs: 00BDAF8F
l, xrefs: 00BDAFC0
s, xrefs: 00BDAF96
n, xrefs: 00BDAFB2
e, xrefs: 00BDAF9D

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Value
String ID: C$H$a$d$e$e$l$l$n$o$s
API String ID: 3702945584-2848555115
Opcode ID: 9e55a1910d997ef5c2b54d57196826eb64d820b380ec577b8e4c197da8a130f7
Instruction ID: 9f7c0919ca6539713435b666ad55030068573690244fb21b8e8e2981cc7dd0f6
Opcode Fuzzy Hash: 9e55a1910d997ef5c2b54d57196826eb64d820b380ec577b8e4c197da8a130f7
Instruction Fuzzy Hash: 16719071D082A88AEB24CB14DC88BEAB675EF54310F1481FAD50DA7380E6B94ED58F65

Function 00BD1BC7 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 166COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-3128998556
Opcode ID: b6938de84791a8b50937ff7c7866f6a91118097a5c994db1d3c028de65770f32
Instruction ID: f7b022fff26471d001e94482b0164dc1c5a68399aa6544cb2c58a2f5fb26c956
Opcode Fuzzy Hash: b6938de84791a8b50937ff7c7866f6a91118097a5c994db1d3c028de65770f32
Instruction Fuzzy Hash: A95104B1C086A49EF7248B14CC49FEABBB4EB90304F0841EFD44D56381EA795EC58F62

Function 00BD9171 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 165registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 730382d71067dd490c8754c455b103f42aa4f209e9b5c7e894cc0a402286aefb
Instruction ID: 484daef2d3d3de5d8043ea827d15ca5bd4e7ec6588bc4d927d3abff4f3338dfb
Opcode Fuzzy Hash: 730382d71067dd490c8754c455b103f42aa4f209e9b5c7e894cc0a402286aefb
Instruction Fuzzy Hash: F95139A2D082949EF7258720DC98BFABBB4EB91304F1441FED44D16782D6B91EC5CF62

Function 00BD8D7F Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 64fe121df96625e84431565d1efb9c479c912395f453e5be106e024919e9b938
Instruction ID: fb1920ab62822b2a06e34a89d5230a93aabab64a89bc426eba75074fb2a84045
Opcode Fuzzy Hash: 64fe121df96625e84431565d1efb9c479c912395f453e5be106e024919e9b938
Instruction Fuzzy Hash: AC511AA1D086989EF7208720DC88BFBBBA4EB91315F1441FAD40D16381EA7D1EC5CF62

Function 00BD747E Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 153fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-3128998556
Opcode ID: 8c7dc25e95c5ada3c9d633e9ec803902349bd54bed9ea5d7d75f65d52ea7fe14
Instruction ID: ae5eefb3fb8e166db5f5d2ef3496fc8da268656ff5522f44b866d5076df7f297
Opcode Fuzzy Hash: 8c7dc25e95c5ada3c9d633e9ec803902349bd54bed9ea5d7d75f65d52ea7fe14
Instruction Fuzzy Hash: BB51E3B1D096988AF7208B24DC44BEABBB5EF91314F0441FAD44C66381EA791FC48F22

Function 00BD8BAB Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 150COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 798aa56db2c05bcfc19e301f5f8fc9b5cea2911aeaeab8b6613a46bb766484aa
Instruction ID: e741e694d74d0a6394d367602c16ecce492c1d354d31a58a69604cbd6d2570b1
Opcode Fuzzy Hash: 798aa56db2c05bcfc19e301f5f8fc9b5cea2911aeaeab8b6613a46bb766484aa
Instruction Fuzzy Hash: 97511761D097A98EF7219B24CC84BEABBB4EF52304F1440FAC44D56381EA791EC5CF62

Function 00BD9080 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,000F003F,?), ref: 00BD9945

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 51ecfc1f336e6c16a084053ed814f3403fc8c749f980018a66cde6bfd706b246
Instruction ID: edc9d7617d3a4c30d112cf27c3f0fe0679963f142626a3808575cad61f478188
Opcode Fuzzy Hash: 51ecfc1f336e6c16a084053ed814f3403fc8c749f980018a66cde6bfd706b246
Instruction Fuzzy Hash: 6951D871D086999DF7248724DC98BFABAB0EB82305F1442EAD44D66381DB791BC5CF12

Function 00BC1290 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 141COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-3128998556
Opcode ID: 18edbe73aafe7e669ce707759348deffba18d59beab084dcf3ab40260cb50317
Instruction ID: 585f383c5697ea59d136aaf1addaa7cd7527f00befe5f700b70983282f3c36ca
Opcode Fuzzy Hash: 18edbe73aafe7e669ce707759348deffba18d59beab084dcf3ab40260cb50317
Instruction Fuzzy Hash: 1F5104B1D086989EF724CB14CC55BAABBB4EB41304F1441EED04D5A382EA795EC5CF61

Function 00BD7A69 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 136fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-3128998556
Opcode ID: 0e47d7cfcca95a172c666399a49ecbd181a58bff36a4d7b455f80af527e99c79
Instruction ID: a66092be0f1e35a2ea4c849ebc176197fa6d33c856ba7513b6290957fd576abc
Opcode Fuzzy Hash: 0e47d7cfcca95a172c666399a49ecbd181a58bff36a4d7b455f80af527e99c79
Instruction Fuzzy Hash: 3351F471D4C6949EF7248724DC99FEABBB4EB51304F0402EED44D56381EAB91AC48F62

Function 00BD666A Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 130COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 1811eed5b5889a84991680e8e51f2eca8e21d74de15f51283a72828af4b27a17
Instruction ID: 49f431280bd2c177f7a435857a6694c2af7358b47afb90356037cd4eec2508e3
Opcode Fuzzy Hash: 1811eed5b5889a84991680e8e51f2eca8e21d74de15f51283a72828af4b27a17
Instruction Fuzzy Hash: 9E513E71D086A88AFB208725DC48BDBBFB4AB51314F0501FBD84C66381E6795EC5CF61

Function 00BA9923 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 127injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-3128998556
Opcode ID: 4355dc4833c65088241cf8e7653ef8f5ad0fed0a633bfc40d92fd9368f81022a
Instruction ID: 1c131853edb98ca91a9f819db7ee823dd8f293dbcce472a6137d3f3bfeedef0b
Opcode Fuzzy Hash: 4355dc4833c65088241cf8e7653ef8f5ad0fed0a633bfc40d92fd9368f81022a
Instruction Fuzzy Hash: 6C4139B2E0C1949EF7258614DC48BEB7BB9DB92300F1440FED40D66681D6BD9BC59F22

Function 00BD667B Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 127fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD6EDE

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 5921d137f8d4d7fe214bbf7ad0fb2c918a052c9a2507416317b8f6d26e4e1e43
Instruction ID: 06382953b9be8f73f36d168bb90276565fa959f65c72b7064959bf3df7ba4154
Opcode Fuzzy Hash: 5921d137f8d4d7fe214bbf7ad0fb2c918a052c9a2507416317b8f6d26e4e1e43
Instruction Fuzzy Hash: 1A411A71D096A88AFB208724DC48BDBBBB4AB51314F0501FBD84D66381EA795EC5CF62

Function 00BAA483 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-3128998556
Opcode ID: 6be80a68f61cf43ffed33944965f5cf9c25d02b72b1a9ad5e3d9d1b1d11e12e8
Instruction ID: 77ecf5e3dfbefb4ebdf79be32f7ffe52e9aaca0a6a1834884ac1f1a5c3c92ec9
Opcode Fuzzy Hash: 6be80a68f61cf43ffed33944965f5cf9c25d02b72b1a9ad5e3d9d1b1d11e12e8
Instruction Fuzzy Hash: 1E4116B1D0C5A89EEB258614DC587EABBB8EB56300F1440EAD40D67681D6BC9BC48F22

Function 00BAA4D9 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 111injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-3128998556
Opcode ID: 8710fbf925675d20293d82441a894abff336fa4202a0fb9582f97ff2f666472f
Instruction ID: f6077c3f97bb23a916fe4449678df670ba2747265c64bd7e9ce199b74b3cc400
Opcode Fuzzy Hash: 8710fbf925675d20293d82441a894abff336fa4202a0fb9582f97ff2f666472f
Instruction Fuzzy Hash: 9741C5B1D0C1A89EEB258614DC547EEBBF9AB96300F1440EAD40D67281D6BC9BC49F26

Function 00BD8A80 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 111COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: bf502c02796b09d4dd4bbe7e71b8aa82aae45f1050d052c9d4bb9eef5693e39a
Instruction ID: 1fb85e8d6ad995863695c5968f9a3be4125b840fad96e37af1a792c0d7ab7bb7
Opcode Fuzzy Hash: bf502c02796b09d4dd4bbe7e71b8aa82aae45f1050d052c9d4bb9eef5693e39a
Instruction Fuzzy Hash: 03412FA1D082989EF7119710DC45BA6BBA4EB12314F0841FFD44D163C2EA7A1AC9CF63

Function 00BD8AF6 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 104COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 56d6aa726657b191d858dda32fcb701573cedcc9f60e515fa22425865f1a52b4
Instruction ID: 1e2c5c29ce7b49b48b9aed5a762200abaa98ea62f0732813f21bb88b51ba0953
Opcode Fuzzy Hash: 56d6aa726657b191d858dda32fcb701573cedcc9f60e515fa22425865f1a52b4
Instruction Fuzzy Hash: B341F961C0C7989DF7218720DC54BAABFA4EB52304F0441FAD48D16282DA7A1AC9CF63

Function 00BD8AE7 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 98COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 871a371614ec35ac3875598b0245349de1caa06b5bd8a7ba9701428e075e01f9
Instruction ID: c527a18dbce432fc827a41a741c62fd7a5572b5b7bdc6e786e4d7732e54bfce7
Opcode Fuzzy Hash: 871a371614ec35ac3875598b0245349de1caa06b5bd8a7ba9701428e075e01f9
Instruction Fuzzy Hash: B7310C51D0C7D98DF7118720DC59BA6BFA4AB12305F1841FEC48D153C2DABA1AC9CB63

Function 00BA9E36 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 97injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00BAA590

Strings

r, xrefs: 00BAE235
E, xrefs: 00BAE212
c, xrefs: 00BAE243
e, xrefs: 00BAE24A
t, xrefs: 00BAE227
s, xrefs: 00BAE251
i, xrefs: 00BAE220
P, xrefs: 00BAE22E
o, xrefs: 00BAE23C
s, xrefs: 00BAE258
x, xrefs: 00BAE219

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-3128998556
Opcode ID: 9c0d14fc411c1d12dfce0a818ffe40fedb9eebf8c3708588f8122a743be36443
Instruction ID: e0574b3395502efcf2510dbd848562813aa0d56429f0ec17052d00a06383f7dc
Opcode Fuzzy Hash: 9c0d14fc411c1d12dfce0a818ffe40fedb9eebf8c3708588f8122a743be36443
Instruction Fuzzy Hash: AD4119B2D0C2A8DEF7218624DC44BDA7BB9EB51310F1444F9D40D67281C6BD9BC49F22

Function 00BD8CDE Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 97COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: Open
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 71445658-3128998556
Opcode ID: 35ee91b2f1ede7411e7affc63d921b99e4ae50d4a3b7ee58736ee0eb45f01c5e
Instruction ID: 7f1a7aa48fd2e33cc075fef0578ad7c6cc4fb469913dd843097b2c2eb94fd88b
Opcode Fuzzy Hash: 35ee91b2f1ede7411e7affc63d921b99e4ae50d4a3b7ee58736ee0eb45f01c5e
Instruction Fuzzy Hash: E8310991D0C3999DF7118720DC94BA6BFA4AB52304F1841FAC44D163C2DABA1AC9CB63

Function 00BD6DE3 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 96fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD6EDE

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 0dfdd5c10a44009503b1ae2f6da10c64a37a5cc40e16120e56d3638abc9a2c34
Instruction ID: 9ce04fcbe9f9fd7e6493147a84ab280f0eed955f4426eef1555b6b411da82dd4
Opcode Fuzzy Hash: 0dfdd5c10a44009503b1ae2f6da10c64a37a5cc40e16120e56d3638abc9a2c34
Instruction Fuzzy Hash: 1D41BA71D096E98EFB20C724CC54BDABFB1AB52305F1442EAC88D66381DB791AC5CF51

Function 00BD16F6 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 94COMMON

Download Yara Rule

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-3128998556
Opcode ID: c2771e18130aed95280a5340e6d2b96c613384021249d47c2bdf426315276427
Instruction ID: 52ae40f6917fa137695e2b65d8e87e12036ceb7ef5139001ce28ca8a8e0b8440
Opcode Fuzzy Hash: c2771e18130aed95280a5340e6d2b96c613384021249d47c2bdf426315276427
Instruction Fuzzy Hash: E0312C61C0D6E88DF7118724DC55FD6BFA4AF11304F1801EAD44D26282DAB95EC9CF62

Function 00BD7F87 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-3128998556
Opcode ID: 04e5aac90ffe176777fc08f4e522d6ec45c31bc4447d7b3cf4cae7d4e9cb815d
Instruction ID: ef14b904ed736c57489300cd3234cd788a59e196afc07954f871b05a38fc9944
Opcode Fuzzy Hash: 04e5aac90ffe176777fc08f4e522d6ec45c31bc4447d7b3cf4cae7d4e9cb815d
Instruction Fuzzy Hash: 9341F970E087A98EEB20CB14CC44BE9BBB1AB55309F1441EAC84D67342DBB55EC5CF51

Function 00BCDBF3 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00BCE7A5

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 637fafc49e75ed0ebaf623883e6fc4afe14dcf90c94e9e31a5200c159330f49f
Instruction ID: f350d24caec58d34ab90d52fcbb94ee6df2635daf0da748678edf5c5c8adba5f
Opcode Fuzzy Hash: 637fafc49e75ed0ebaf623883e6fc4afe14dcf90c94e9e31a5200c159330f49f
Instruction Fuzzy Hash: B431CA61C0D7D89DF7218724DC59FDA7F94AB12304F1442EAD48C662C2DAB95AC9CF22

Function 00BD7B92 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 58fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,3A42A905,?,00000000), ref: 00BD82D4

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileWrite
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 3934441357-3128998556
Opcode ID: 825a4686f2956fa830331826e1bd2f8b954823909b5090f36fb268dfd81aba08
Instruction ID: fa5c5d97434941adec3a81bbfd71dba4719f6ca266ab7b799398d5689b0846e4
Opcode Fuzzy Hash: 825a4686f2956fa830331826e1bd2f8b954823909b5090f36fb268dfd81aba08
Instruction Fuzzy Hash: E221C961E0D6D889F7218735CC58F99BFA4AB52305F0442EEC48C16382DAB91BC98F62

Function 00BD1C05 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 57fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD2347

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-3128998556
Opcode ID: 09c0a735f2586e01e79ef1f2b313c070a6ba90d048467c0623b94986b166adfa
Instruction ID: 86d6fccaa684073dc4a987e4b8eaed6620185d61fef35f3cab420882f2b991b5
Opcode Fuzzy Hash: 09c0a735f2586e01e79ef1f2b313c070a6ba90d048467c0623b94986b166adfa
Instruction Fuzzy Hash: D721C951D0D6D88DFB21C724CC88F9ABFA0AF52304F0841D9D48C56382DBB91AC99F62

Function 00BD17D3 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 55fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD2347

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FileRead
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-3128998556
Opcode ID: 8fbd8980e236e1a2e31128579a8ef00d6e049bb8db11780596a2ee4383da1b9c
Instruction ID: f6d76f6ec937ea2a4e0e715ddd0afb0d61a92f1fdd5fe4e9c07a6820da653b41
Opcode Fuzzy Hash: 8fbd8980e236e1a2e31128579a8ef00d6e049bb8db11780596a2ee4383da1b9c
Instruction Fuzzy Hash: 1821D861D0D6D88DFB21C724DC48F9ABFA0AF52304F0841DDD48C56382DAB91AC99F72

Function 00BD6375 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00BD6EDE

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CreateFile
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 823142352-3128998556
Opcode ID: 88f12ccde75dfaba21ca7020fb7a37fa4fa99d965d76e1f32518fd1c00ea2228
Instruction ID: e413f9c64ae54346edd559ccbae0e607b563f53aceb8f1eaf81423263dac5930
Opcode Fuzzy Hash: 88f12ccde75dfaba21ca7020fb7a37fa4fa99d965d76e1f32518fd1c00ea2228
Instruction Fuzzy Hash: C8218B61D4D7D889F7218724DC49FD9BFA06B12304F1442E9D48C263C2DBBA2AC99F62

Function 00BDC012 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 227COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00BDC39F

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CloseHandle
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2962429428-3128998556
Opcode ID: e42b2f0a50d0da1cb59ff54555e08853320dbe1ec57e97e670e1b9f11954ce91
Instruction ID: a5dbc84f11fbf62868f92b900889bd9ba9e6c2bf6494e8a033952271010ffdc6
Opcode Fuzzy Hash: e42b2f0a50d0da1cb59ff54555e08853320dbe1ec57e97e670e1b9f11954ce91
Instruction Fuzzy Hash: 44B16D71E0866A8BEB24CB14DC94BAABBB1BF89305F1481EAC80D67741D7745EC1CF91

Function 00BDB82D Relevance: 18.0, APIs: 1, Strings: 11, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00BDC39F

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CloseHandle
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2962429428-3128998556
Opcode ID: 809bed1dca5e3baa709d1d4fa26489373cc25eee148682d7ac848f8516beccb2
Instruction ID: 8078f543741c79f57d7bd2eae3e99d9b7880e51c24ca56556398e00244560506
Opcode Fuzzy Hash: 809bed1dca5e3baa709d1d4fa26489373cc25eee148682d7ac848f8516beccb2
Instruction Fuzzy Hash: DE119A51D0D6D8C9FB118724DC48F99BFA06F52305F0442E9C48C16382DABA1AC98F62

Function 00BDBC6D Relevance: 18.0, APIs: 1, Strings: 11, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00BDC39F

Strings

c, xrefs: 00BDC3D6
x, xrefs: 00BDC3AC
t, xrefs: 00BDC3BA
P, xrefs: 00BDC3C1
s, xrefs: 00BDC3EB
o, xrefs: 00BDC3CF
r, xrefs: 00BDC3C8
s, xrefs: 00BDC3E4
E, xrefs: 00BDC3A5
i, xrefs: 00BDC3B3
e, xrefs: 00BDC3DD

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: CloseHandle
String ID: E$P$c$e$i$o$r$s$s$t$x
API String ID: 2962429428-3128998556
Opcode ID: 2c5e1f12b801ae12fba4520269cdc16c5a3f03724d7529193d9f3b979c6da131
Instruction ID: 5fe5091aba70fafea4f9840d83e3cfdda7f2137d1f9ea683a3da932c16d7a0af
Opcode Fuzzy Hash: 2c5e1f12b801ae12fba4520269cdc16c5a3f03724d7529193d9f3b979c6da131
Instruction Fuzzy Hash: 56118C51D0D6D8C9FB11C724DC59F99BFA0AF52345F0441E9C48C16383DBB91AD98F62

Function 00B7644D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0
9M;H, xrefs: 00B7644D

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9M;H$V
API String ID: 544645111-758971650
Opcode ID: ac7351aad4c96df22349ac49e5cd5c555ae806751718c1cc866b9bbea5bf8bd1
Instruction ID: 6e08296354084312e4e103e8c22fe43bb9b67ba7e2f4fc2e99e669279649bf88
Opcode Fuzzy Hash: ac7351aad4c96df22349ac49e5cd5c555ae806751718c1cc866b9bbea5bf8bd1
Instruction Fuzzy Hash: 5D51F8B1D045289FE7248B10DC95BFB77B8EB54310F1481FEE95EA6241D639AFC08E51

Function 00B666DA Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B66A00
VirtualFree.KERNELBASE(?,00000000,00010000), ref: 00B66A48

Strings

, xrefs: 00B66A99

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 5e05ee3926bfa5936bef5d75e821fe910db5efc5227748a3cd91c5e3e079ac24
Instruction ID: f87fd94fc5c831a75306f249275c430d3eee767dc1b9a5494ef460bc6245a9f7
Opcode Fuzzy Hash: 5e05ee3926bfa5936bef5d75e821fe910db5efc5227748a3cd91c5e3e079ac24
Instruction Fuzzy Hash: 47A13974E052288BDB24CB54CC94BAEB7B5FB89315F2481EAD84DA7640D778AEC1CF41

Function 00B662A6 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B66A00
VirtualFree.KERNELBASE(?,00000000,00010000), ref: 00B66A48

Strings

, xrefs: 00B66A99

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 1cc5c825936b22456448a9e0ba7d9c239ed2ff27f3dab9c6c209a0506f0d23e2
Instruction ID: d6aceaa73382b6b57d58a203195b7f5e1448ab6ec0e693cac40021409e880812
Opcode Fuzzy Hash: 1cc5c825936b22456448a9e0ba7d9c239ed2ff27f3dab9c6c209a0506f0d23e2
Instruction Fuzzy Hash: D141F5B2F01758ABE7248A55DC44FAB77B9EBC5310F1441FAE50DA6680D678AFC08F12

Function 00B66966 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B66A00
VirtualFree.KERNELBASE(?,00000000,00010000), ref: 00B66A48

Strings

, xrefs: 00B66A99

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 27b3125f57ef9b16a7d81d2f4e0186782d7fcdd923e31fc65c4bf0efa28e449e
Instruction ID: 60f5a04aa6580f2bbd4bb4a8ff4f98d9da67dc4cd2c741eb7f378c2f0dbeb953
Opcode Fuzzy Hash: 27b3125f57ef9b16a7d81d2f4e0186782d7fcdd923e31fc65c4bf0efa28e449e
Instruction Fuzzy Hash: 22319C71B016689BEB34CA91DC84BBAB7B5FB89311F1491E9E44DA6280D6789EC1CF01

Function 00B65EFB Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B66A00
VirtualFree.KERNELBASE(?,00000000,00010000), ref: 00B66A48

Strings

, xrefs: 00B66A99

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 73af3c92e3f3227d54cc13b1dade6e64ca78aa4e66082d8070c26785c67e7c65
Instruction ID: 43b4d49d5b02b513105091f719ea82ca318a51fabaf5cccc6523320e8820ba8e
Opcode Fuzzy Hash: 73af3c92e3f3227d54cc13b1dade6e64ca78aa4e66082d8070c26785c67e7c65
Instruction Fuzzy Hash: ED11B971F40314ABE7348A91DC45F7AB7B8FB84710F1441E9E50DA6680D6789EC08F12

Function 00BAB69D Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

;2=5, xrefs: 00BABE75

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: ;2=5
API String ID: 0-500833759
Opcode ID: a096bdf15092cc7897f4075b2d9446c82148a4d4b693b3d91269e73bd1ca050c
Instruction ID: 0c55a04991656ae1ebf307e1c064759aad09fc38580a30bc45e263261badf1f1
Opcode Fuzzy Hash: a096bdf15092cc7897f4075b2d9446c82148a4d4b693b3d91269e73bd1ca050c
Instruction Fuzzy Hash: 25E18CB5D086689BEB24CB24DC94AAAB7B5FF49304F1081EAD449A7342D3389FC5CF41

Function 0052DE62 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Strings

, xrefs: 0052E24B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-399585960
Opcode ID: c554af85ba18191bcc1543b1c1733980d10a98ad8b7e1d97797c7d5be7e5bf7a
Instruction ID: ff0f508deb0c1a9eb847c5a44c1bbb5bca08e7516a30803109d6e09e0dd02b0a
Opcode Fuzzy Hash: c554af85ba18191bcc1543b1c1733980d10a98ad8b7e1d97797c7d5be7e5bf7a
Instruction Fuzzy Hash: 69B147B5E012298BEB24CF14DD80BE9BBB5FF95300F1081EAD94D67291D631AE91CF91

Function 00B7645A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: 250091907695454bbd73f1b0ef751050cdb95c95e87f8e03ef026fd0bfa3b4de
Instruction ID: 998a926a0bb730557df387ea4b420d02b42fcd750668750433bade5d96f1852f
Opcode Fuzzy Hash: 250091907695454bbd73f1b0ef751050cdb95c95e87f8e03ef026fd0bfa3b4de
Instruction Fuzzy Hash: 7951F9B1D046289FE7148B10DD95BFB77B8EB54310F0481FAE95EA6241D6386FC08F51

Function 00B76472 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: 0f7f6f612a543812b46db7e2a92914a9438d9a8beb25506175377ede90b58cf2
Instruction ID: 8e6a982001afc9a268b0f9f48613609726806ba3eee7f99f990c8fbc3c61091f
Opcode Fuzzy Hash: 0f7f6f612a543812b46db7e2a92914a9438d9a8beb25506175377ede90b58cf2
Instruction Fuzzy Hash: 9841D4B1D046289FE7248B10DC95BFBBBB8EB54310F1081EAE95EA6241D6389FC08E51

Function 00B764CD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: 63adcc080bc5b8617762b7d3646a76a51220801fa81926d20a6d9617fd6b5adb
Instruction ID: 2cc073f5cd0127b429509e94670ffdae79c0b507c6ceb0806f449fc5b053816e
Opcode Fuzzy Hash: 63adcc080bc5b8617762b7d3646a76a51220801fa81926d20a6d9617fd6b5adb
Instruction Fuzzy Hash: EF41EAB1D046289FE7248B10DC95BFB7BB8EB54310F0081FAD95EA6241D6395FC58F51

Function 00B7632D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: 1234fbf8be5bb268f41cc19695f2382092362745804b2a2e864ccd6e1e579a1e
Instruction ID: f4869d3acea29dafbc48c140da561ba9ceb1c3624497ff64b9e90ee741428df8
Opcode Fuzzy Hash: 1234fbf8be5bb268f41cc19695f2382092362745804b2a2e864ccd6e1e579a1e
Instruction Fuzzy Hash: 5F4127B1C086689FD7109B20DC84BEBBBB8EF59310F0481EAD95DAA242D3359FC48F51

Function 00B76516 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

V, xrefs: 00B765A0

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-2161188062
Opcode ID: d4d96d11506c7e03d4a1ad92248a8d8f4a33c666aa48d95a3bcaef0e9ca20e6c
Instruction ID: 97a495aa4f0deeed39107ba271ebd67965e6154eae0e984f164cafeb331147ac
Opcode Fuzzy Hash: d4d96d11506c7e03d4a1ad92248a8d8f4a33c666aa48d95a3bcaef0e9ca20e6c
Instruction Fuzzy Hash: 7541FAB1D086689FE7148B10DD95BEBBBB8EF58310F0041FAD95EA6241D239AFC08F51

Function 00516768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Strings

>LGI, xrefs: 00516768

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID: >LGI
API String ID: 544645111-4161275100
Opcode ID: a734c6eae7066c59f8ae480d20e7b49d441490e8554827ba2ca483eed26588ff
Instruction ID: 2f5412f5c6be3960f5493caa24a753fb2b9e62e6141cbcdba3622e64ffbe4d36
Opcode Fuzzy Hash: a734c6eae7066c59f8ae480d20e7b49d441490e8554827ba2ca483eed26588ff
Instruction Fuzzy Hash: 9E11DFB5D055399BFB208A54CC94AFABB74FB81305F1482EAD84E67280DA391FC0CF91

Function 0052D734 Relevance: 1.8, APIs: 1, Instructions: 292COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 90b277cb9a960d288cb00e86fd4e0be92392042adfb7ff2aa8c16c42a7151c22
Instruction ID: efe8de338dc0b0ec0e67c55200b277b0a6467b7770ef4f5e211431a2a66eb98b
Opcode Fuzzy Hash: 90b277cb9a960d288cb00e86fd4e0be92392042adfb7ff2aa8c16c42a7151c22
Instruction Fuzzy Hash: 9FC15CB5D042688FEB24CB14EC94BEABBB5FF85314F1441EAD80967281DA395EC18F50

Function 0051640E Relevance: 1.7, APIs: 1, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9f7cf688856c6a34a5fd7900edf6f5bc01a90dfdaf97f9968384dc90e0790627
Instruction ID: 7cc69cf26d9599b982bcfc7fa3b485d425e6ca8b6914484ab82600c54d4ee584
Opcode Fuzzy Hash: 9f7cf688856c6a34a5fd7900edf6f5bc01a90dfdaf97f9968384dc90e0790627
Instruction Fuzzy Hash: 7C71EFB2D015289BFB248B14DC85AEBBB79FF84311F1482FAD80D66640E6395EC6CF51

Function 00516226 Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1574ad791cca3137cac240738d2d79421ea39c2822f8ec6b303c8533d07fd22
Instruction ID: b223166158b87abf29b362595db907a2fd109a320ec5295c89b31d37eda707cb
Opcode Fuzzy Hash: e1574ad791cca3137cac240738d2d79421ea39c2822f8ec6b303c8533d07fd22
Instruction Fuzzy Hash: 0B51D0B2D115249BFB248B14DC55AEB7B78FF84311F1482FAD80E66640E6395EC2CF91

Function 0052C513 Relevance: 1.7, APIs: 1, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b2dbd3062df50e9b268aecffb83f3ac9a1946cecae8384dc3d4bbbb37f907789
Instruction ID: 87ac3e6ea144e18c2a1e44d76c66caabe327e1c4ba2a660d089eda493c83ebe1
Opcode Fuzzy Hash: b2dbd3062df50e9b268aecffb83f3ac9a1946cecae8384dc3d4bbbb37f907789
Instruction Fuzzy Hash: 708159B4D055288BEB24CB14DC94BEEBBB1BF96301F1881E9D80967282D635AED1CF45

Function 00516358 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c669b0b7b007100f4cfa411b1c38627e1af0f339464c16e85beb0acf4641f807
Instruction ID: 50814b49a1c60d713d7a72a98864b06fbbc74fe5508f3fc961e753f4d4a238d9
Opcode Fuzzy Hash: c669b0b7b007100f4cfa411b1c38627e1af0f339464c16e85beb0acf4641f807
Instruction Fuzzy Hash: 4451E0B2D055259AFB248B10DC45AFABB74FF84311F1482FAE80E66680E6385EC1CF51

Function 00B7670D Relevance: 1.7, APIs: 1, Instructions: 168memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,00B76550,?,?,?,?,?,?), ref: 00B7696A

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a6fb40e716de551a96391ea82a394f56a78fedfa0a860ce8ae4594a93b1365fc
Instruction ID: 6281e4f59cea8036d2f28b98c7ad8a1691974098ba8b420f17fd2815c524e1e3
Opcode Fuzzy Hash: a6fb40e716de551a96391ea82a394f56a78fedfa0a860ce8ae4594a93b1365fc
Instruction Fuzzy Hash: 7251DEB1D095689BDB28CB14DCD4BEABBB5EB45300F1481EAE91E66241C634AEC1CF91

Function 00516277 Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ea61dda1c274db46c9be2692d10b1ad17e7e80ca8826f2c2aa79e8631bf8f3
Instruction ID: b938f31d2192623e8c44dd4052a22f8a8e6787b170e8e8be616c1922171343e7
Opcode Fuzzy Hash: f8ea61dda1c274db46c9be2692d10b1ad17e7e80ca8826f2c2aa79e8631bf8f3
Instruction Fuzzy Hash: 2651EFB2D015259BFB248B14DC55AFBBB74FF84301F1482BAE80E66640E6395EC2CF91

Function 00516085 Relevance: 1.7, APIs: 1, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b35ac62f5e629131703b561acb6b4abb2940b6997d287c3790fdbe735fb44ae5
Instruction ID: 474e1e0dfb4439b745df6bd69523a557007376bc47e9fddff643ecc93672a2aa
Opcode Fuzzy Hash: b35ac62f5e629131703b561acb6b4abb2940b6997d287c3790fdbe735fb44ae5
Instruction Fuzzy Hash: 2451D4F6D05665ABF7208A14DC58AEB7B78FBC0310F1481FAD40D66680DA786FC1CA92

Function 00516285 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd20145a70e8ab658d03e27552b68220e5ee23168779aa7905e487a29bee80d
Instruction ID: cc865447c04de299893f4cea9537cdb2ec82bacb825f7c07e9d34d8abb8ce2f5
Opcode Fuzzy Hash: ccd20145a70e8ab658d03e27552b68220e5ee23168779aa7905e487a29bee80d
Instruction Fuzzy Hash: 9D51E0B2D015259BFB248B14DC55AFBBB78FF84311F1482BAD80E66640E6395EC2CF91

Function 005165BD Relevance: 1.7, APIs: 1, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1ad6f1e374225c40b2108ac9a4baa660100450ea2adfc19ebbf8a247d4ea991c
Instruction ID: af6c77bc400c5299f66149a8ed101318a5fa2539f8351af4775a34fd71c909f9
Opcode Fuzzy Hash: 1ad6f1e374225c40b2108ac9a4baa660100450ea2adfc19ebbf8a247d4ea991c
Instruction Fuzzy Hash: DA616E71D055289BEB24CB14CC90AEABBB5FB85315F14C1EAD80DA7241D639AFC0CF91

Function 00B767C6 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c311b45253368e361d10724aa29d2644b677f0aee532b43ea2a3d643b390c3
Instruction ID: 433f599636aea0052c4bfb52a2cfad03a540d069ee9b73d31b4353b87726918a
Opcode Fuzzy Hash: b5c311b45253368e361d10724aa29d2644b677f0aee532b43ea2a3d643b390c3
Instruction Fuzzy Hash: A95101B1D095689BDB18CB50DC90BFEBBB4EB45300F14C1EEE96E66241D634AE81CF42

Function 0052D915 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19b727f9f91a6c180f4bed54e0c5b28e6ca2e92f585d71a7b230b56ae9dd052
Instruction ID: aa96f77bff8be2df72c19e92987dbdb7b6d42c2bea2f50e465d65e2061b3d6bb
Opcode Fuzzy Hash: f19b727f9f91a6c180f4bed54e0c5b28e6ca2e92f585d71a7b230b56ae9dd052
Instruction Fuzzy Hash: A851FAB1D045A49BEB24CA10EC94BFA7F75FFC2312F1881EAE80965281D6395EC5CE21

Function 0052DAA3 Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 52d0614e75be7ddbb40bf9ca0b696141d988fdff0ef1481668a4c0a4c3ee35a8
Instruction ID: e042a9f57101243a602d988c0bf292da987503ebf93f57188248b2dd69c86646
Opcode Fuzzy Hash: 52d0614e75be7ddbb40bf9ca0b696141d988fdff0ef1481668a4c0a4c3ee35a8
Instruction Fuzzy Hash: ED41BFB2D001349FF7248A14ED59FFB7B78EB84310F1541BAE90E66280D6795FC58EA1

Function 00B83013 Relevance: 1.6, APIs: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 52d79ba6600ccd78758206f8f9f589c1f4a52e0b5619b1a93f47927a5c40f75b
Instruction ID: 3c80f69a102b7d1e427474ef955ad910ceba8412266e3aceea20be4ccea33733
Opcode Fuzzy Hash: 52d79ba6600ccd78758206f8f9f589c1f4a52e0b5619b1a93f47927a5c40f75b
Instruction Fuzzy Hash: EA41E7B2E045149BE7248A15DC95AEBBBB9DB80710F1082F7E90DA6240D27DAFC58E61

Function 00516172 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2497aa0cdb0447dabd10148dc36d2b00160dbd0034921eb7d7b12031914ede83
Instruction ID: c55da142f11614ae13ad6652ef676b8702ed33fb1ae592a92b477ab9fa010484
Opcode Fuzzy Hash: 2497aa0cdb0447dabd10148dc36d2b00160dbd0034921eb7d7b12031914ede83
Instruction Fuzzy Hash: F93137F2D05624AFFB108A10DC99BEB7B68FF81310F1441FAD40E6A641E6795EC1CB91

Function 005161D4 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3e90f6bf0adfcf64ed937810087d932f1d43f6f8312735674202c7cc4de0c88b
Instruction ID: 72ca47be62f78648a94c450a2450afda9f2cac060f5bc6449ff30b3d802eef1a
Opcode Fuzzy Hash: 3e90f6bf0adfcf64ed937810087d932f1d43f6f8312735674202c7cc4de0c88b
Instruction Fuzzy Hash: FD3149F2D005249BFB208A14DC59BF77B64FB80310F1482FAD40E66640EA796FC5CE92

Function 0052C1C6 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ced530babf6fcb01ab8179f89b4ee09b77a12d2ff9680e037333e66113577a29
Instruction ID: 574edc7990d5fe2264659817b6a99f4d7d3d31ff74436c5d032010878c01f55c
Opcode Fuzzy Hash: ced530babf6fcb01ab8179f89b4ee09b77a12d2ff9680e037333e66113577a29
Instruction Fuzzy Hash: 06419FB1D041289FEB248B10DC94BBA7B78FF82310F5885FAD94956281DB399EC5CB52

Function 0051601E Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bf80db46c8da15c9886d1e89a05c30b1634dd03e2582e7900bfde292bf9ca53d
Instruction ID: cef7964c2f595d2cfa3bcdb48c05b1f1c052abc688dfdd5e89a0e920a0f5596b
Opcode Fuzzy Hash: bf80db46c8da15c9886d1e89a05c30b1634dd03e2582e7900bfde292bf9ca53d
Instruction Fuzzy Hash: 1131C6B2D056659BFB218664CC88AEB7BB8FF85300F1541FAE40CA7141EA395FC1CB91

Function 0052C6EB Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4202a6b4d8c9d9f86d23b32a076f4253cf524c730dcc17f9e4956a7daefc642f
Instruction ID: d717afef89266bca8b88d771fb497ac509b2da62543dd3086575f680df487620
Opcode Fuzzy Hash: 4202a6b4d8c9d9f86d23b32a076f4253cf524c730dcc17f9e4956a7daefc642f
Instruction Fuzzy Hash: 654182B1D049798BEF24CA14DC947EE7FB1BFD2306F1880E9D84A66282D6395EC58F41

Function 0052C09E Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0d6a42de1fef59fe292f2ee5a905195a1ea6d73e9de2191a5461602933615ace
Instruction ID: ca6576d658c7595abe4d65b2bcb465624d6f8fbe5185ed8fdbe32100ac45584d
Opcode Fuzzy Hash: 0d6a42de1fef59fe292f2ee5a905195a1ea6d73e9de2191a5461602933615ace
Instruction Fuzzy Hash: 6631C3B6D442645BF7258A64DC94ADBBFB8FF45300F1581F9E90DA2281DA3C9EC0CB91

Function 00B83062 Relevance: 1.6, APIs: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f3a9ea3c2d9f327521e77b2569a13baa7c873dd4add23cabc6ef3305211bde1d
Instruction ID: fd84367d1d98f02b81aca12518271911067eb63bffd3c3eaf9b0ef637d06f9c9
Opcode Fuzzy Hash: f3a9ea3c2d9f327521e77b2569a13baa7c873dd4add23cabc6ef3305211bde1d
Instruction Fuzzy Hash: 1A31E9B2E145249BE7148A14DC94BEBBBB9DB80710F1082F7E50DA7240D278AFC1CF61

Function 00516053 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f2237f3198e1d872c8d82f573c010ed42fffea4a0538e706e17171e4a08e1da6
Instruction ID: 083b4f5be78c59365858d130aebac190a9ef5e0102f6910f323d007d347aefb4
Opcode Fuzzy Hash: f2237f3198e1d872c8d82f573c010ed42fffea4a0538e706e17171e4a08e1da6
Instruction Fuzzy Hash: 4321F8B3D04665AAF7208664DC48DEB3BA8FB84310F0541B6E50DA7540E93D5FC2CB92

Function 00B6E002 Relevance: 1.6, APIs: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00B6E071), ref: 00B6E0BC

Memory Dump Source

Source File: 00000000.00000002.405226371.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B6E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b6e000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6ac16dc820cde0b60eeabd5abbfcc106beac5426af54aa67ec493fda904815c8
Instruction ID: 729604f74c87eccf654ea6388f135bde87fec3ec4d1095515dff0795b45b9229
Opcode Fuzzy Hash: 6ac16dc820cde0b60eeabd5abbfcc106beac5426af54aa67ec493fda904815c8
Instruction Fuzzy Hash: E03134B4D042689FEB208B20CC95BFA7BB5EB85300F1081EAD55E26281D6799EC1DF52

Function 00B765EF Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 675fed681b120844ca9434b8e1fdc9567fd796d6c99160e7ceb29db1e2855b62
Instruction ID: 66fcd8ba15a624882a533a4968db49a6f39e32ead3d1f442e0c20b25c627ccb8
Opcode Fuzzy Hash: 675fed681b120844ca9434b8e1fdc9567fd796d6c99160e7ceb29db1e2855b62
Instruction Fuzzy Hash: D631D9B1D086689FD7249B20DD84BEABBF4EB49310F0041EAD55DA6541C2349FC18F51

Function 00B76838 Relevance: 1.6, APIs: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,00B76550,?,?,?,?,?,?), ref: 00B7696A

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 12c9bc5fb485d22c31bcbbecc4339207962b160b3615507030b4568e4586de40
Instruction ID: 109fd186ca4be32b862f0879161027cbd80cb59b348ca69222e4ec7e53ae4448
Opcode Fuzzy Hash: 12c9bc5fb485d22c31bcbbecc4339207962b160b3615507030b4568e4586de40
Instruction Fuzzy Hash: 8C31F4B1D096289BDB28DB50DD84BEABBB4EB49310F1081EFE65E66141C634AFC0CF51

Function 00B8374E Relevance: 1.6, APIs: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8e036ccf7f3ce0aee5309d0051ee27f414367289d6acdfde907844a49695fbee
Instruction ID: 2c9ba374dbd9b4999f40dfb58b1b1297e61eb0e81c1de022420d601621ac9451
Opcode Fuzzy Hash: 8e036ccf7f3ce0aee5309d0051ee27f414367289d6acdfde907844a49695fbee
Instruction Fuzzy Hash: 7031DBB2E045249BD7148B15CC94AEBBBB9DB80711F1082FAE90DA7240D6786FC1CF61

Function 00B8349B Relevance: 1.6, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 265892ae1684c53c9a9e70bbc7d90c304c69347b0dcd2597cd3a0e62eabb5cc5
Instruction ID: 151b0de0b571a76151a935554903d5a821f6294956683a04a1c157e6caf8ae81
Opcode Fuzzy Hash: 265892ae1684c53c9a9e70bbc7d90c304c69347b0dcd2597cd3a0e62eabb5cc5
Instruction Fuzzy Hash: 0231B8B2E045249BD7248A55DC94AEABBB9DB80711F1082FAE90DA7240D6786FC1CF61

Function 00B834F2 Relevance: 1.6, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: af863a6fc02f2902528d2b125cefa6a1bb73a6a2da302145b8057d5e833b8f07
Instruction ID: bb061e3ca314efe8475f0df0aaeab29cf6afeef6d757388bfee0bf07117344dd
Opcode Fuzzy Hash: af863a6fc02f2902528d2b125cefa6a1bb73a6a2da302145b8057d5e833b8f07
Instruction Fuzzy Hash: 2331B8B2E045249BD7248A55DC94AEBBBB9DB80711F1082F6E90DA7240D6786FC1CF61

Function 00B834CD Relevance: 1.6, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 56e4c9b0916afe0146a56ea8575144fca977ae29e5a5f50b59129fe1741ee19e
Instruction ID: cbfd4704513dbce2608e994d4b9ad8e1c863a76a8646726abe17ffae71a3c953
Opcode Fuzzy Hash: 56e4c9b0916afe0146a56ea8575144fca977ae29e5a5f50b59129fe1741ee19e
Instruction Fuzzy Hash: E331D8B2E045249BD7248A55CC94AEABBB9DB80711F0082F6E90DA7240D6786FC1CF61

Function 00B83473 Relevance: 1.6, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 265892ae1684c53c9a9e70bbc7d90c304c69347b0dcd2597cd3a0e62eabb5cc5
Instruction ID: 151b0de0b571a76151a935554903d5a821f6294956683a04a1c157e6caf8ae81
Opcode Fuzzy Hash: 265892ae1684c53c9a9e70bbc7d90c304c69347b0dcd2597cd3a0e62eabb5cc5
Instruction Fuzzy Hash: 0231B8B2E045249BD7248A55DC94AEABBB9DB80711F1082FAE90DA7240D6786FC1CF61

Function 00B8378A Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8b018cc981cfbf6fd5ba36512310854eb637f2efda3bb0411187dc26c59da34a
Instruction ID: b230fe847f0049f704efb29b0201cda60b4b84404362501b53dde2b0f25fb842
Opcode Fuzzy Hash: 8b018cc981cfbf6fd5ba36512310854eb637f2efda3bb0411187dc26c59da34a
Instruction Fuzzy Hash: C921F6B2E041249BE7148A15DC94BEBBFB9DB81711F0082F6E90DA7240D2786FC1CF61

Function 00B83795 Relevance: 1.6, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5b8d8a910a072811fb2e6108d4ee2d555d9245297ab66476263bb7b993add953
Instruction ID: 0f5797b44d34eca36424bcf2981116dec0ef7bb719b7359d586dd718d7a96033
Opcode Fuzzy Hash: 5b8d8a910a072811fb2e6108d4ee2d555d9245297ab66476263bb7b993add953
Instruction Fuzzy Hash: 0D21C9B2E045249BE7248A55DC54BEBBFB9DBC1711F0482F6E50DA7240D2786FC18F61

Function 00B7622B Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1737eb261ac29a38ecc4aaf70bf870dd7da8846afb1dc6433ccfe0d78c7cd830
Instruction ID: 9fdde0333c34e151502ac88c6f87639cd4f6eb9fed4a911869cce8e11688ec63
Opcode Fuzzy Hash: 1737eb261ac29a38ecc4aaf70bf870dd7da8846afb1dc6433ccfe0d78c7cd830
Instruction Fuzzy Hash: 3121FCF2D085286BE7249610DD85BEBBBF8EB49310F0441F9E65E66141D135AEC48F51

Function 00B6E04F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405226371.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B6E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b6e000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a6e62c86c0d1f69469d0ee50064698a24715fb7da4012d90153eb93a04405b2a
Instruction ID: 5f0d913a3543fbd26047a1463650e6bb7835ed38a32d4b85f8dafdaf5250e82c
Opcode Fuzzy Hash: a6e62c86c0d1f69469d0ee50064698a24715fb7da4012d90153eb93a04405b2a
Instruction Fuzzy Hash: 022136F4D042649FEB218B24CD45BEB7BB5EF86300F0081F9E54E26641D639AEC59F62

Function 00B6000B Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00B60033

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d441e7c930d7a07b87cf53ee78991f1bc9391a258f3aab0429a1bfb72070b7a8
Instruction ID: b618ed51adff127fde5616f128088146ad96d83b89c9e6cc353dab169cb76d42
Opcode Fuzzy Hash: d441e7c930d7a07b87cf53ee78991f1bc9391a258f3aab0429a1bfb72070b7a8
Instruction Fuzzy Hash: BA21C761E282189AF7149B24DC81BAB7275EFA4300F1050FDA14DE7390EA7E5EC18F16

Function 00BB504F Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00BB50EE

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6be490dc1a5b398263cc23def1f59266bb9b3ab34468a1a7378bfbe89f96b9e8
Instruction ID: df9567ac61e0b4432db2f082350faaf9401ddeb2f7cdafbe0b762ae0f9ccf66c
Opcode Fuzzy Hash: 6be490dc1a5b398263cc23def1f59266bb9b3ab34468a1a7378bfbe89f96b9e8
Instruction Fuzzy Hash: BF21C476E006299FEB318A25DC54BFEB779EB84340F0442FAD45DA6280C7B45EC18E51

Function 00B766B1 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d2f1fd69057c0e370ac8d58a5b7d622ee7215916dfb7dc964022ab77f9bded2c
Instruction ID: 47c41bd20b7c128ec49b8533eb3e14cc7c71d253aeecb531908d0f68e26a6713
Opcode Fuzzy Hash: d2f1fd69057c0e370ac8d58a5b7d622ee7215916dfb7dc964022ab77f9bded2c
Instruction Fuzzy Hash: 8D21C6B1D08628ABDB249B60DD84BEABBF4EF49310F0041EEE65E66141C635AEC1CF51

Function 00B7668C Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5a49e4fcac5f4618c2c7195cd746f05921d0ce652d5c1635f5d1328af8055033
Instruction ID: 3eae2f86fd0ae03faf5959d2d8d2656704e4f745ca1173178ff778f8ec137fe8
Opcode Fuzzy Hash: 5a49e4fcac5f4618c2c7195cd746f05921d0ce652d5c1635f5d1328af8055033
Instruction Fuzzy Hash: 0821D8B1D08628ABDB24DB60DD84BEABBF4EF49310F1041EAE65E66141C635AFC1CF51

Function 00B7665A Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405233032.0000000000B76000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B76000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b76000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cf1dd8b0cd2eea2f2404c2fa16e9db18515950d0c51f28c6494cbb8578e63d02
Instruction ID: cc0dae2fd2c05c27fe3b1f05e594d98d43b4a76b6e1fbaa4965a32893e6521e5
Opcode Fuzzy Hash: cf1dd8b0cd2eea2f2404c2fa16e9db18515950d0c51f28c6494cbb8578e63d02
Instruction Fuzzy Hash: 5B21DBB1D08628ABD724DB60DD84BEABBF4EF49310F0041EAE65EA6141C635AFC1CF51

Function 00BB5081 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00BB50EE

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3d2af6a2795c16948f56b5e225d75b09f828bc4cf8e542d87041c66385f0dfd6
Instruction ID: 34b874390269cdc3c200f22584f13ac4695937b11bc45b12945a86235f02bc9c
Opcode Fuzzy Hash: 3d2af6a2795c16948f56b5e225d75b09f828bc4cf8e542d87041c66385f0dfd6
Instruction Fuzzy Hash: A921D776E006189FEB21CA24DD54EFEB779EBC4300F0541FAE84DA6240C6B45FC18E51

Function 0052D78B Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d8f5b5deb6d15679f1204885d0f6049cbfa02726c42b55280a370ef9efeec04a
Instruction ID: 455f911fc3e7216263fc65e69637965ebbe65679d914848acc4f0b583c6fd418
Opcode Fuzzy Hash: d8f5b5deb6d15679f1204885d0f6049cbfa02726c42b55280a370ef9efeec04a
Instruction Fuzzy Hash: BB11D2B29082249AF7118A10EC65FFB3F7CEF81310F1445AAE80991180D6398EC59E62

Function 00B837AF Relevance: 1.6, APIs: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00B837D6

Memory Dump Source

Source File: 00000000.00000002.405240422.0000000000B83000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B83000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b83000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d007334596a68478b238f8108889cd8c8af2edd9a255cff95396b61c1879849
Instruction ID: e327c88ff22dc3e2c093850ab9e1adcffcf0c00aa9a51281339ceeb3ac6852f4
Opcode Fuzzy Hash: 5d007334596a68478b238f8108889cd8c8af2edd9a255cff95396b61c1879849
Instruction Fuzzy Hash: 6121D7B2E045249BD7158B54CC54BEBBBB9DB84711F0482F6E90DA7240D2386FC18F61

Function 00516777 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b87c599eaba3335d35c2b350f127603f5e982eb708b4bfc2cb3f1c012651efce
Instruction ID: c5d3df093b3132e1d53060068741c00a9fae53f7fc7ed98153e9ff3e2f6bf6fa
Opcode Fuzzy Hash: b87c599eaba3335d35c2b350f127603f5e982eb708b4bfc2cb3f1c012651efce
Instruction Fuzzy Hash: 9911DFB5D055399BEB208A54CC94AFA7BB4FB81315F1482EAD84E66280D6391FC1CF91

Function 00B6E089 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00B6E071), ref: 00B6E0BC

Memory Dump Source

Source File: 00000000.00000002.405226371.0000000000B6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B6E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b6e000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: eed37646e25388b313d3175c74a952e3b43323a9a245f328b195d470246b459c
Instruction ID: f96c03272150c76c93528793eb735da6677f9055263f880da0462be8383df8db
Opcode Fuzzy Hash: eed37646e25388b313d3175c74a952e3b43323a9a245f328b195d470246b459c
Instruction Fuzzy Hash: 34110BB5D042549FDB218B24CC55BEB7BB5BF85300F0081E9D54E66282D7399DC1DF61

Function 00BCA68F Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00BCAAB6

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 635041275309e5365403b05d10e9a5ab12912987e2f25c9d1958b276335473b3
Instruction ID: d8ad6161f4e5cbeaec32a6da4c7d8749a2e7817f16bdd9b0168b98254511392d
Opcode Fuzzy Hash: 635041275309e5365403b05d10e9a5ab12912987e2f25c9d1958b276335473b3
Instruction Fuzzy Hash: 311196F5D4422EAEE7208A10DDD0FBA77B9FB45314F1080FED90966640D6795EC09F52

Function 0052DE07 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ed46f56d482a8023abf2c56810186881da28350a6c2cb6f0afaab47d5ea36111
Instruction ID: e5cf714c7a92485f08e2550ad50b9f84d240e6b6dbe80b737c27c73c2adeba83
Opcode Fuzzy Hash: ed46f56d482a8023abf2c56810186881da28350a6c2cb6f0afaab47d5ea36111
Instruction Fuzzy Hash: A71182B2D011358FF7248A64DD08AFABA78EB95310F1141F5D90D2B6C0DA785EC18EA1

Function 0052E154 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a68fe9f20dd43b5e606ebcf5e118277248dd4e4fe9902c518bdbf40782de3df2
Instruction ID: b18dccd889e2270bce6cedf89dcb92af3c13fc70de465ac1221a0cf7acd54df7
Opcode Fuzzy Hash: a68fe9f20dd43b5e606ebcf5e118277248dd4e4fe9902c518bdbf40782de3df2
Instruction Fuzzy Hash: 61119D71C1592DCEEB20CA14EC857E9BBB5BF86306F1481FAC86E26684D2344FC18F81

Function 005160E5 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 55c4e9651654614afb34c422c40b0eb7acafefdebb39ecbee4bf50b9ae9d3b56
Instruction ID: 56efe34573067a4e7d1e553dfcc945923b746ee4f939b62def5d7de776c8cc3f
Opcode Fuzzy Hash: 55c4e9651654614afb34c422c40b0eb7acafefdebb39ecbee4bf50b9ae9d3b56
Instruction Fuzzy Hash: 1101D6F6D01635A7F7104694DC98BE77B68FF80301F1882B6E90D76144D67D6FC18AA1

Function 0052C7BD Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a6200e245b01ac63839a256450ad4ef92d0693a2adef9da15a8680b8db14369
Instruction ID: 7f22e580f21bda0a0b4af3df8de02159ea53938c5d265b27f5cfaa021636a827
Opcode Fuzzy Hash: 8a6200e245b01ac63839a256450ad4ef92d0693a2adef9da15a8680b8db14369
Instruction Fuzzy Hash: 2111E771D041698BEB30CB14EC84BEE7FB5BF86300F1485E9C40D66282D6385AC1CF01

Function 0052D69E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(00000000), ref: 0052E244

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b68cff3e82c3f6a97176897a85b670f73ac60f08d9fb51eed968fb12f5cbe92e
Instruction ID: 8df2d2d7174b5bd3d25801443c2f64ed2f6873f6e1bd7300caea648dcbbcae00
Opcode Fuzzy Hash: b68cff3e82c3f6a97176897a85b670f73ac60f08d9fb51eed968fb12f5cbe92e
Instruction Fuzzy Hash: 06F068A3F054606FF3504129ED197EB2E29EF82320F194572DC4D961C0C57D6A9995B2

Function 00516561 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 233005552ac12a2893c6fd5df115408a6497d0f857e8cb124f3905dd3181cf63
Instruction ID: a5e0602d50a2872d7bb6584a3ded90dd4e5214503315bdba79857543fd57a759
Opcode Fuzzy Hash: 233005552ac12a2893c6fd5df115408a6497d0f857e8cb124f3905dd3181cf63
Instruction Fuzzy Hash: B8017CB6D01635ABEB108A54CC54AEB7B78FF80301F1481BAE90D66240E6795FC1CF91

Function 0051650A Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54e3de1d01772f429c34797c15e771fc9ae80e8bf30858fdc15cba0322f41356
Instruction ID: 90160c2c21dc50013e0fcd27f8da4fcf861e9030eeed482b7b66ab2d9eacc8ca
Opcode Fuzzy Hash: 54e3de1d01772f429c34797c15e771fc9ae80e8bf30858fdc15cba0322f41356
Instruction Fuzzy Hash: 7D017CB6D01635ABEB108A54CC54AEB7B78FF80301F0481BAE90D66240E6795FC0CF91

Function 0051653C Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,005161D3,?,?,?,?,?,00000000,?,?,?), ref: 00516845

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b1c1069d3f5c00e1887d0dfcd14104660d7b97ca954e9e577ed66c8bc20717d9
Instruction ID: 40f9c03b9b5ebe354373787c5d429a69a296f84c27b2428700ad12bc70fa4ace
Opcode Fuzzy Hash: b1c1069d3f5c00e1887d0dfcd14104660d7b97ca954e9e577ed66c8bc20717d9
Instruction Fuzzy Hash: 07017CB6D01635ABEB108A54CC54AEB7B78FF80301F0481BAE90D66240E6795FC0CFA1

Function 0052C117 Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7f279a7871bebb628bf2dec5e18178eaf1609e2803674fd1e39bb130b0094741
Instruction ID: 6bb69739430c08f4578f89d93d9fe8cb72fad3a4a155145fe1d1fe058991e6d8
Opcode Fuzzy Hash: 7f279a7871bebb628bf2dec5e18178eaf1609e2803674fd1e39bb130b0094741
Instruction Fuzzy Hash: 62F027A2E042956BFB248730DC98BEA7F397F96300F5880F8D20D46182DE3C89C1CB02

Function 0052BCF4 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,FFFFCFAF), ref: 0052C85B

Memory Dump Source

Source File: 00000000.00000002.405100636.0000000000516000.00000020.00000001.01000000.00000003.sdmp, Offset: 00516000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_516000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a596fbe3bf391eea436fb1ae0a1366d50747ba19c9b49842e0053ddbbb1a0641
Instruction ID: 7a95471868b5c8f372dbfed48b9032dc8ba1b7e0921b8d907b32b99a1caec8c1
Opcode Fuzzy Hash: a596fbe3bf391eea436fb1ae0a1366d50747ba19c9b49842e0053ddbbb1a0641
Instruction Fuzzy Hash: D2E092B1E082A59FFB148730EC94BEA7F786F47300F5880ECE20955182DE388AC4CB02

Function 00BCA38C Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00BCAAB6

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f552f40bae87865ce4078299db211e41310ad749ae9021a04f8f1cb4013ff4ba
Instruction ID: 6ebe024d94f0812f8c4227ad1e407d5eaf56e8c8decc536d6c1aa157a6f9e1a7
Opcode Fuzzy Hash: f552f40bae87865ce4078299db211e41310ad749ae9021a04f8f1cb4013ff4ba
Instruction Fuzzy Hash: 64E08CB190012E6AE7308B20CD94FBEB3B9AB44304F0480EDF109F2140EB305E80EF42

Function 00BC9F4F Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00BCAAB6

Memory Dump Source

Source File: 00000000.00000002.405257083.0000000000BB5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BB5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb5000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a08b50ade2f509c040be1279d0755058dbfa4387699b4cf9a93f87bfbf9c7a16
Instruction ID: d32a80751813a8327b93f6c3db962157c1f34b5369d8e59881e4079323dde6a5
Opcode Fuzzy Hash: a08b50ade2f509c040be1279d0755058dbfa4387699b4cf9a93f87bfbf9c7a16
Instruction Fuzzy Hash: A8E08CB1A0012E6AE7308B20CE94FBEB3B9AB44304F0480EDF109B2140EB305E80EF42

Function 00B6495E Relevance: 1.5, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2caedd00877bf2e97da2f531fbb9fb481285d55b7e6ec5d569140cd266ac213f
Instruction ID: 6d1d07547bb2e3bde97c6ac09f3926c740765b4bb0f5e6e7764bffd7252c516a
Opcode Fuzzy Hash: 2caedd00877bf2e97da2f531fbb9fb481285d55b7e6ec5d569140cd266ac213f
Instruction Fuzzy Hash: C69105B1D046289EEB208B54DC84BFAB7B9FF84311F1481FAE449A6280E7785EC1CF11

Function 00B650A1 Relevance: 1.5, APIs: 1, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9481f9b1c7d60771a83170bb6268f9442166f42da5c488cd5e8d2181317b63db
Instruction ID: c1538bcbc78bc8ab29f242b7cbfc8ade90c7749ab9dc724a7a324ce198c281ae
Opcode Fuzzy Hash: 9481f9b1c7d60771a83170bb6268f9442166f42da5c488cd5e8d2181317b63db
Instruction Fuzzy Hash: 0A91D2B2D016298FEB248F14DC95BEAB7B5EB84310F1481FAE80967280E6795FD1CF51

Function 00B6502B Relevance: 1.4, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259018e0ca010326c4440b92fb479cbb317efea2594b6b970e98505f0676fa8f
Instruction ID: 2400a1deb795a3b2706ddadbb64d6dd4afb263efe7c884f6ee82537c619103c2
Opcode Fuzzy Hash: 259018e0ca010326c4440b92fb479cbb317efea2594b6b970e98505f0676fa8f
Instruction Fuzzy Hash: 3771A1B2D116299FE7248B24DC95BEAB779EB84310F0481FAE80D67240E6785FD1CF51

Function 00B64829 Relevance: 1.4, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b379ba9b1ea15f3d6094a498f45365243b19f98b5941fc0d944dc37938e2bdde
Instruction ID: 9fec0fa270f6762e40ed47f57d4cc75edd70f3f18ddfc83cf478f97b74f64790
Opcode Fuzzy Hash: b379ba9b1ea15f3d6094a498f45365243b19f98b5941fc0d944dc37938e2bdde
Instruction Fuzzy Hash: 2261E1B2D106599EE720CB64DC84BEBBBB9EF84310F1081FAD409A6684E6785EC1CF11

Function 00B65047 Relevance: 1.4, APIs: 1, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c2d2eae533997a016c257304f807bde45be91cb578f46afde0eca1bf0534ad
Instruction ID: e8f7b067893c864675ee1b4fc353e423daba65eb936761063572c0689e993bd0
Opcode Fuzzy Hash: 86c2d2eae533997a016c257304f807bde45be91cb578f46afde0eca1bf0534ad
Instruction Fuzzy Hash: B861B1B2D106299FE7248B24DC95BEBB779EB84310F0481FAE80D66240E6785FD1CF51

Function 00B6486B Relevance: 1.4, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 25fd3f550f87bb62af27ae690eaefdd544f6fe9b941f3a2bddb78c407c15a599
Instruction ID: 1a2defb65769cdb3e67f32f556d322eb0024e380b8e7f949a3c6dd66249ea738
Opcode Fuzzy Hash: 25fd3f550f87bb62af27ae690eaefdd544f6fe9b941f3a2bddb78c407c15a599
Instruction Fuzzy Hash: 175102B2D106599EE720CB64DC847EABBB9FF84310F1085FAD449A6684E6785EC18F11

Function 00B64EC3 Relevance: 1.4, APIs: 1, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 43f52e2d4c7523de15a6f77e2199b0d3c31eeb2699f7523c1b6f38d076da280a
Instruction ID: 1c4081da61925a3c0ca4bb0b52e5f9a4a6317a796989e3c509da55bb45753433
Opcode Fuzzy Hash: 43f52e2d4c7523de15a6f77e2199b0d3c31eeb2699f7523c1b6f38d076da280a
Instruction Fuzzy Hash: 5151B2B2D006699FF724CB24DC96BEB7B78EB40310F0441FAE84E66680DA795FC58E51

Function 00B6471F Relevance: 1.4, APIs: 1, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d8cfac07b8d9f7ee08585e29ffc7fc80e351504ed3b3881ee60e6509b52bbc8
Instruction ID: 4a9e5a73b3a618b05a78c129e0a4132f7f96be803c46ebff0b598abda3dbacff
Opcode Fuzzy Hash: 1d8cfac07b8d9f7ee08585e29ffc7fc80e351504ed3b3881ee60e6509b52bbc8
Instruction Fuzzy Hash: 4951B5A1D096A89FF721C724DC48BAABBB9EB91310F1481FAD44C66681D37D1FC48F61

Function 00B64946 Relevance: 1.4, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c5aee289fe6f7f76301a5224dac7a17fc3744be644ce51ff837452c2c0f41f06
Instruction ID: f98d678ac0accd7c2b97bc013eeb03c6267c35fb7d86e59a798a40c2a46cdc18
Opcode Fuzzy Hash: c5aee289fe6f7f76301a5224dac7a17fc3744be644ce51ff837452c2c0f41f06
Instruction Fuzzy Hash: C94134A2D156559FE720CB60CD48BFABBBAEBC0300F1086FAE048A6584D67C1BC1CF10

Function 00B6513B Relevance: 1.4, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0972956a0d198b8550002ff812ec09e50316b228a5a1189e5f972b10bcb2fc9b
Instruction ID: 1619c35c39eaed96bb99a62f86c0c68ca35fedea08027ee1b46e36b3ead1559c
Opcode Fuzzy Hash: 0972956a0d198b8550002ff812ec09e50316b228a5a1189e5f972b10bcb2fc9b
Instruction Fuzzy Hash: E841A2B2D102699FE7248B25DC55BEAB7B9EB94310F0081FAE80D66280D6785FD1CE51

Function 00B64A36 Relevance: 1.4, APIs: 1, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0fd56cf125cc8d046d5c4e4547b8034ab07f639ff7c688a52f0788f90bc3c36f
Instruction ID: 90919b67a2d37c9d5c1cf2bcaa34bbd5c0be07af558ced9c26cbe41122803c72
Opcode Fuzzy Hash: 0fd56cf125cc8d046d5c4e4547b8034ab07f639ff7c688a52f0788f90bc3c36f
Instruction Fuzzy Hash: AE31C0B2E40658AFE724CB14DD88BAA77BAEBC0310F14C1FAE00966584D7785FD18F11

Function 00B64A50 Relevance: 1.3, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 31e2b60e2f010ab1bc6489deb28ef46bf237da711247eceb3482599788e3c95c
Instruction ID: 00cfc56f631469c8b0df31e0c1e97f3ab8347742f67631fe0ffececc3fc8e646
Opcode Fuzzy Hash: 31e2b60e2f010ab1bc6489deb28ef46bf237da711247eceb3482599788e3c95c
Instruction Fuzzy Hash: 9F31C2B2E50668AFE724CB14DD48BEAB7B9EB80310F14C1FAE00966584D7785FC18F11

Function 00B64A06 Relevance: 1.3, APIs: 1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2ce78cf1a05af5f0010d301364fa6c4ebe56110a2a2c3e2b6827174198787956
Instruction ID: c5ac2d419841c1e6696cd21569a43e34fd8dfc434ca802bbd220257d4f731e7b
Opcode Fuzzy Hash: 2ce78cf1a05af5f0010d301364fa6c4ebe56110a2a2c3e2b6827174198787956
Instruction Fuzzy Hash: 6A3102F2D10658AFE724CA20DC48BEABBB9EBC0310F14C6FAE04966584D27C5FC18E11

Function 00B647CB Relevance: 1.3, APIs: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: afe69fd15d697fa3a12c1875169fe887963f6138be513b57fdef79011531017c
Instruction ID: 5396b485691c208f723202c2ac746e3dc3d6debf4da5ff3868d8ce735a55e283
Opcode Fuzzy Hash: afe69fd15d697fa3a12c1875169fe887963f6138be513b57fdef79011531017c
Instruction Fuzzy Hash: D131E4B2D546589FF724CA20DC48BAA7BB9EBC0310F14C6FAD04966584D27C5FC18F11

Function 00B64830 Relevance: 1.3, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5e9daa855710538a1898a0b5212b7a18aafdb1e9b0b9777cb5f44b39451bc1
Instruction ID: 2c532ed9050a885df7a9f94e7f97e6cc067b8dfeb6e66e9b5eba6025e7011b76
Opcode Fuzzy Hash: 1e5e9daa855710538a1898a0b5212b7a18aafdb1e9b0b9777cb5f44b39451bc1
Instruction Fuzzy Hash: 4A31D1B2D50669AFF724CA20DD48BAA7BB9EB80310F14C6FAE00966584D67C5FC18F11

Function 00B65016 Relevance: 1.3, APIs: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ab2fe601e5ecd090fb2131016379287933016f1e00d37954087b9a3edea7bcfc
Instruction ID: 34ebb267b08f503d2fa12c7e470f3ce8e48390bccee14d3062b6fd135dfb87c9
Opcode Fuzzy Hash: ab2fe601e5ecd090fb2131016379287933016f1e00d37954087b9a3edea7bcfc
Instruction Fuzzy Hash: 0F3190B1D103599FF728CB24DC95BEABB79EB40310F0042FAE40A66680D6B85FC18E51

Function 00B64A9A Relevance: 1.3, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7d4ec270115c2d62ea4a509e810590c9f0259f9bca971b716098ff63fbf97c7d
Instruction ID: abcf8d2bd804262695b4f8fc14b692fa3978ea270ef6f18221a0d30ae3f0c9f9
Opcode Fuzzy Hash: 7d4ec270115c2d62ea4a509e810590c9f0259f9bca971b716098ff63fbf97c7d
Instruction Fuzzy Hash: 3D2101F2E106589FE724CB20DD49BAA7BB9EB80310F0486FAE00866584D6B85FC18F11

Function 00B65283 Relevance: 1.3, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 00190a2174beb706a8dc170be7d181acbecfc56825942c668e7856bb17a2dfe2
Instruction ID: a52deb9f39692e3811525e986111f1b02bfa1b93d3318a2e23d100ff66a6cc10
Opcode Fuzzy Hash: 00190a2174beb706a8dc170be7d181acbecfc56825942c668e7856bb17a2dfe2
Instruction Fuzzy Hash: 983150B2D103699FE728CB24DC95BE9BB79EB44310F0042FAE50A66680DB785FC1CE50

Function 00B64AC4 Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87a4a2f565848450fe825f5bd13230755c2113bd7dc338f72fe18b7a95d93e52
Instruction ID: d93eac95e5a2c9a421bc9289775f05dd746a67a9d66513218bb4c443e6f5482c
Opcode Fuzzy Hash: 87a4a2f565848450fe825f5bd13230755c2113bd7dc338f72fe18b7a95d93e52
Instruction Fuzzy Hash: 94210AB2D107585FE725DB20CC09BE97BB9EB80310F0485FAE00866584D6785FC1CF10

Function 00B6556D Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b73123dea08335d80990d429a54d3b3fd4fd98cdb0b4dbe69a0d899445788b2f
Instruction ID: 032d3ef4a262b56fcd18a81bdd609be5a7f347321a1339ce9a90c719f20389a7
Opcode Fuzzy Hash: b73123dea08335d80990d429a54d3b3fd4fd98cdb0b4dbe69a0d899445788b2f
Instruction Fuzzy Hash: A521A5B1D042A98FEB39CB14DC597EDBBB6BB85314F1082EAD44A66580D6741BC1CF01

Function 00B64AE1 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 51652734916b6677e2ed214491320ce317ac26a63c283d3b594dd2eaaaaef73d
Instruction ID: 2eea9d93ca8da9202b803756e61dbc2f8b86b7069a2d42fc63046d185a777d14
Opcode Fuzzy Hash: 51652734916b6677e2ed214491320ce317ac26a63c283d3b594dd2eaaaaef73d
Instruction Fuzzy Hash: 2B11D3B2E113A49FF725CB14DD09B9ABAB9EB80310F0482FAE00D76584D6781F81CF41

Function 00B64AEB Relevance: 1.3, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0cf4c377b398c2c08de1e821c306350c4fdd20669603f64c6de66a487eec8e67
Instruction ID: addcc9b703d1bd8aaca017cdee12c884321604f853892c343d655c0ef1078868
Opcode Fuzzy Hash: 0cf4c377b398c2c08de1e821c306350c4fdd20669603f64c6de66a487eec8e67
Instruction Fuzzy Hash: B11190B2E113A59FE725CB15CD09BD9BAB9EB80310F0482FAE0097A584D6B85FC1CF41

Function 00B64F12 Relevance: 1.3, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?,?,?,?,?,?,00B64959), ref: 00B65675

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4c8d096912e4c667b4d9e24f20f40b4be24092d580adbfc32804c40fb80a22be
Instruction ID: 9ccd05e2cdea6cd79fa44c9536f61f3b021117e53993c2706dc539b321c2d630
Opcode Fuzzy Hash: 4c8d096912e4c667b4d9e24f20f40b4be24092d580adbfc32804c40fb80a22be
Instruction Fuzzy Hash: 821191B1E103A99FE725CB15DD19BD9BAB9EB80310F0481EAE40D76580D6B45BD1CF41

Non-executed Functions

Function 00B61CB2 Relevance: 46.9, Strings: 37, Instructions: 699COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
@BCF, xrefs: 00B61B8D
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
ZQ, xrefs: 00B61B83
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: @BCF$A$E$F$P$V$V$W$ZQ$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3398744922
Opcode ID: 6a1b0f42f156e91bf65496541e6a60d0d0487ff355217ec66be3b9c80bcced50
Instruction ID: 94522f5a72c760408fc0a0c8ec7c4aa8d8834c2446328de797ea3dcc180bbd11
Opcode Fuzzy Hash: 6a1b0f42f156e91bf65496541e6a60d0d0487ff355217ec66be3b9c80bcced50
Instruction Fuzzy Hash: 06521791D086948AF7218B24DC157EB7AB9EF91300F0480F9D48D9B382DA7E4FC58F66

Function 00B61AF0 Relevance: 46.9, Strings: 37, Instructions: 665COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
@BCF, xrefs: 00B61B8D
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
ZQ, xrefs: 00B61B83
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: @BCF$A$E$F$P$V$V$W$ZQ$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3398744922
Opcode ID: 422f53593c2a363ff521e8d871ef4badd5bb710b589919503412c057cee50274
Instruction ID: 5dc08fbc5fc599775ca4594fa390105a2ace4d952bf993a156a8b94cd285c7bd
Opcode Fuzzy Hash: 422f53593c2a363ff521e8d871ef4badd5bb710b589919503412c057cee50274
Instruction Fuzzy Hash: 46421651D08694CAF7218B24DC147EB7AB9EF91300F0480F9D58DAB282DA7E4FC58F62

Function 00B61AFD Relevance: 46.9, Strings: 37, Instructions: 662COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
@BCF, xrefs: 00B61B8D
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
ZQ, xrefs: 00B61B83
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: @BCF$A$E$F$P$V$V$W$ZQ$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3398744922
Opcode ID: c49b53b845f74eb1810722434199e46a255f8b6da36f422db305eb0120cba2f8
Instruction ID: 991b4fb5dc0fc1c42b690c98df66f3c8faa8be98143e6fe0dbd20877b6eb2c8f
Opcode Fuzzy Hash: c49b53b845f74eb1810722434199e46a255f8b6da36f422db305eb0120cba2f8
Instruction Fuzzy Hash: 1D420651D086948AF7218B24DC157EA7BB9EF91300F0480F9D58DAB382DA7E4FC58F66

Function 00B62018 Relevance: 46.0, Strings: 36, Instructions: 957COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
OHKJ, xrefs: 00B6252B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$OHKJ$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-1280823467
Opcode ID: de77cc56dbf79c5f08c02929a52ced337d526c3980dcb1b69c3c9af83fbabe0f
Instruction ID: 5aaff024eb252719f92ca7479b19db4cbfba9864e41ed318eb15cf3939c5d893
Opcode Fuzzy Hash: de77cc56dbf79c5f08c02929a52ced337d526c3980dcb1b69c3c9af83fbabe0f
Instruction Fuzzy Hash: A58213A1D086648BFB248B24CC947EABBB5EF91300F1481FAD54DA7281D67E4FC18F52

Function 00B62473 Relevance: 45.5, Strings: 36, Instructions: 547COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
OHKJ, xrefs: 00B6252B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$OHKJ$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-1280823467
Opcode ID: f62e2403f95dae90fd48ac2a027fe5df17e0dc31dfb7467e7d1ee82adfb677a4
Instruction ID: 659b24b7cf5687cd01e30ce22b92ff797fa5a82ec26b645cbc360e8595564181
Opcode Fuzzy Hash: f62e2403f95dae90fd48ac2a027fe5df17e0dc31dfb7467e7d1ee82adfb677a4
Instruction Fuzzy Hash: 52222761D086948EF7218724DC447EB7AB9EF91300F1480FAD58DA7682DA7E4FC58F62

Function 00B62495 Relevance: 45.5, Strings: 36, Instructions: 540COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
OHKJ, xrefs: 00B6252B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$OHKJ$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-1280823467
Opcode ID: 1d7f77c28fbcc1d89d947a7a10dd30b62a0a53d56d08bcefe0ab6d00d36e5f8a
Instruction ID: cf2cf619023564dd2892ee32cde0189a815755bd8102d7ed7fd8a767b67b34ea
Opcode Fuzzy Hash: 1d7f77c28fbcc1d89d947a7a10dd30b62a0a53d56d08bcefe0ab6d00d36e5f8a
Instruction Fuzzy Hash: 50222891D086948EF7218724DC447EB7AB5EF91300F1480FAD48DAB682DA7E4FC58F62

Function 00B619A1 Relevance: 44.4, Strings: 35, Instructions: 630COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 070f24c4940b48b03915c80923faefef98ea7070be7aa6de052caf1bb52a0b95
Instruction ID: 402760dad62da09830fe6da129dbd89f5ca33014aeffcf485207fa1753bbe4f2
Opcode Fuzzy Hash: 070f24c4940b48b03915c80923faefef98ea7070be7aa6de052caf1bb52a0b95
Instruction Fuzzy Hash: CA420651D186948EF7218724DC157EB7AB5EF91300F0880F9D48DAB282DA7E4FD58F62

Function 00B61C2D Relevance: 44.4, Strings: 35, Instructions: 613COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 4a5640e0505f863db0f4ed28266b663f83c7668b32ab46b1033030b1a95be253
Instruction ID: 312b5ca1abdd3ada685d2c42cffe75cc88513189650d4484debd5c3fd955961d
Opcode Fuzzy Hash: 4a5640e0505f863db0f4ed28266b663f83c7668b32ab46b1033030b1a95be253
Instruction Fuzzy Hash: ED321751D186948AF7218724DC057EB7AB9EF91300F0880F9D48DAB382DA7E4FD58F66

Function 00B61A42 Relevance: 44.4, Strings: 35, Instructions: 612COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: f7c58e7463a10101e897bc26b2bdbe947758415b249bd2ff6365d93a6f6daa33
Instruction ID: 22317d645d1382f9a5482c220f77464cbc4b39fc0f0065f9aaad70f437234ac1
Opcode Fuzzy Hash: f7c58e7463a10101e897bc26b2bdbe947758415b249bd2ff6365d93a6f6daa33
Instruction Fuzzy Hash: E7321791D18694CAF7218724DC057EB7AB5EF91300F0880F9D58DAB282DA7E4FD58F62

Function 00B61C3A Relevance: 44.4, Strings: 35, Instructions: 608COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 91bd1c6ede6d87e12d8dad8ec1e323c1e60b91943c76324f5fd0ed1a42cc51cc
Instruction ID: 4b6b341331b25ee525b35cbc8a5572e1b108750ec82fd5e37013bf30000dd450
Opcode Fuzzy Hash: 91bd1c6ede6d87e12d8dad8ec1e323c1e60b91943c76324f5fd0ed1a42cc51cc
Instruction Fuzzy Hash: 58321751D186948AF7218724DC057EB7AB5EF91300F0480F9D48DAB382DA7E4FD58F66

Function 00B61F84 Relevance: 44.3, Strings: 35, Instructions: 568COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 9a1fee824a24895e421214a865711ed35ad06a5c15eee45eda351ff4dd63b84f
Instruction ID: d5ce7099c926833d5b604594e02efcab9898330607ff329875e8bb93bbdbacc4
Opcode Fuzzy Hash: 9a1fee824a24895e421214a865711ed35ad06a5c15eee45eda351ff4dd63b84f
Instruction Fuzzy Hash: 99222891D086948AF7218724DC157EBBAB5EF91300F0480FAD58DA7282D67E4FC58F62

Function 00B61F95 Relevance: 44.3, Strings: 35, Instructions: 560COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 25ebaebfbe0f933113e5bd41ca2340877bc776ada64ed208db4ed253cc15c0ce
Instruction ID: f51237495fadc70a7a0d1aadea400ec0e7e538759d8f6dea5779ab5c00becc67
Opcode Fuzzy Hash: 25ebaebfbe0f933113e5bd41ca2340877bc776ada64ed208db4ed253cc15c0ce
Instruction Fuzzy Hash: B0221791D186948AF7218B24DC157EBBAB5EF91300F0480FAD58DA7282D67E4FC58F62

Function 00B61E6E Relevance: 44.3, Strings: 35, Instructions: 555COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 5158d973525d3245446374a735f938ff5e1bb34e097cea5c37048e79e6ac50c0
Instruction ID: 18ea38c9d6b18820d6d4460f9150606d44550f1837131a598e812422330d28a2
Opcode Fuzzy Hash: 5158d973525d3245446374a735f938ff5e1bb34e097cea5c37048e79e6ac50c0
Instruction Fuzzy Hash: 872229A1D186948EF7218724DC157EB7AB9EF91300F0480FAD48D9B682D67E4FC58F62

Function 00B61DB2 Relevance: 44.3, Strings: 35, Instructions: 554COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 655842746e56bd93d78cec8e2970e2ac809f3e89020c543a8b2d37db79e1e7eb
Instruction ID: c59ce68d0d6353ab21f2baf6dc8e84e3b1da321c95a33b45804c85ccdc9b48f6
Opcode Fuzzy Hash: 655842746e56bd93d78cec8e2970e2ac809f3e89020c543a8b2d37db79e1e7eb
Instruction Fuzzy Hash: 7D221751D086948EF7218724DC157EB7AB9EF91304F0880F9D48DAB282D6BE4FD58F62

Function 00B62001 Relevance: 44.3, Strings: 35, Instructions: 541COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 689a69a76c15bf9f6261aa01689f59d8db5d9044c3348eae24f85cb225d2869c
Instruction ID: d668d9a85d3288a449cb56b3718a5188801e01845b40eddd6baca6caeae2183c
Opcode Fuzzy Hash: 689a69a76c15bf9f6261aa01689f59d8db5d9044c3348eae24f85cb225d2869c
Instruction Fuzzy Hash: 1B222891D086948EF7218724DC157EB7AB9EF91300F0480FAD58DAB282D67E4FC58F62

Function 00B620F3 Relevance: 44.3, Strings: 35, Instructions: 520COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 4f8ca2b7cb10115d5c12cf0091e0a87cbd1aeda25cf0dce96c724b82effc5a33
Instruction ID: 4a75c3d300e11568be528a65efdd2df2dc914fbcc28be8b0d7a81375adc837e3
Opcode Fuzzy Hash: 4f8ca2b7cb10115d5c12cf0091e0a87cbd1aeda25cf0dce96c724b82effc5a33
Instruction Fuzzy Hash: 23121691D186948EF7218724DC157EB7AB9EF91300F0480F9D58DAB282DA7E4FC58F62

Function 00B61E84 Relevance: 44.3, Strings: 35, Instructions: 507COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 1eac3e2bbfce2d4d7f6f3c9935902e747575fe73a4f3d2549b0a33f42fa625e2
Instruction ID: 2970df52afdb32cf2bf088a697cd43cae36092d02a15a122cbb286432f00c5cf
Opcode Fuzzy Hash: 1eac3e2bbfce2d4d7f6f3c9935902e747575fe73a4f3d2549b0a33f42fa625e2
Instruction Fuzzy Hash: 93122791D186948EF7218724DC057EB7AB9EF91300F0480F9D58DAB282DA7E4FC58F62

Function 00B620CF Relevance: 44.3, Strings: 35, Instructions: 506COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 915c3653b1cc71b8cb5da0251f35eb666f8e9faceeb79565faa68153a24cb411
Instruction ID: a76c9d5b9d1c09c4bdee4a45380a7df1b5f5697a4914d3cff9be1fcaf1c76ded
Opcode Fuzzy Hash: 915c3653b1cc71b8cb5da0251f35eb666f8e9faceeb79565faa68153a24cb411
Instruction Fuzzy Hash: FC122851D186948EF7218724DC157EB7AB9EF91300F0480F9D58DAB282DA7E4FC58F62

Function 00B61E81 Relevance: 44.3, Strings: 35, Instructions: 505COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 00b98fe3f7c8e248a4de29bd147b4437c2433179db556c66f63a719a078aebea
Instruction ID: 123965c919efc47da25022d102a92b2873062993a593057522d193796324352c
Opcode Fuzzy Hash: 00b98fe3f7c8e248a4de29bd147b4437c2433179db556c66f63a719a078aebea
Instruction Fuzzy Hash: 93122891D186948EF7218724DC157EB7AB9EF91300F0480F9D58DAB282DA7E4FC58F62

Function 00B625AA Relevance: 44.2, Strings: 35, Instructions: 475COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 65c5bd4306010dcf074e629c3409451be0ad170dd998889044f60be6923d2eca
Instruction ID: 84bce479145edd72b5b3d55e866e083a05c30b9cad67dbe7127aa8d6c1176966
Opcode Fuzzy Hash: 65c5bd4306010dcf074e629c3409451be0ad170dd998889044f60be6923d2eca
Instruction Fuzzy Hash: 2512F851D186948EF7218724DC047EB7AB9EF91304F0480F9D48DAB682DA7E4FC58F66

Function 00B6219B Relevance: 44.2, Strings: 35, Instructions: 475COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: e76da6366241342b4abff546b6c45f0551e9d57413459a6df4272321ee21b67a
Instruction ID: fe66f988116dd269d6e65194e9d13dde6577c1f35f5d7fa60c504a936d8ec25a
Opcode Fuzzy Hash: e76da6366241342b4abff546b6c45f0551e9d57413459a6df4272321ee21b67a
Instruction Fuzzy Hash: A8120751D186948AF7218724DC147EB7AB9EFA1300F0480F9D48CAB782DA7E4FC58F66

Function 00B62C65 Relevance: 44.2, Strings: 35, Instructions: 471COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: f69d95b59c591acf368640ef5fba07b6a3c8a2491470b182f66ec57f9302b471
Instruction ID: 00fb849587a1795374ffa214179b4c868fbc2f5c4583ed9187e1163bb16abef7
Opcode Fuzzy Hash: f69d95b59c591acf368640ef5fba07b6a3c8a2491470b182f66ec57f9302b471
Instruction Fuzzy Hash: 6212F651D186948EF7218724DC047EBBAB9EF91304F0481F9D48CAB682DA7E4FC58F66

Function 00B62A34 Relevance: 44.2, Strings: 35, Instructions: 469COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: cd5a3d52826bcad6a960efa4bb0fedda1ac2298720f23047b342b970cd89bb54
Instruction ID: 4abdaacf127f0799c9ccf8acf73a30bc4e80aebc6c258a1fa86993b5a06286f0
Opcode Fuzzy Hash: cd5a3d52826bcad6a960efa4bb0fedda1ac2298720f23047b342b970cd89bb54
Instruction Fuzzy Hash: D712F651D186948EF7218724DC047EBBAB9EF91300F0480F9D48CAB682DA7E4FC58F66

Function 00B62A0F Relevance: 44.2, Strings: 35, Instructions: 469COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: 9d9ffa6288bada0185f49cbaff3d168b02424045deea673ebecacaf1296f899f
Instruction ID: 34c5902ba6ae3b035a325588f71fcf31e0ae23578b1057eda2b564cbd7e2824c
Opcode Fuzzy Hash: 9d9ffa6288bada0185f49cbaff3d168b02424045deea673ebecacaf1296f899f
Instruction Fuzzy Hash: 7D12F651D186948EF7218724DC047EBBAB9EF91304F0480F9D48DAB682DA7E4FC58F66

Function 00B629B5 Relevance: 44.2, Strings: 35, Instructions: 469COMMON

Download Yara Rule

Strings

i, xrefs: 00B62CAE
u, xrefs: 00B62D42
c, xrefs: 00B62DF9
o, xrefs: 00B62CCA
V, xrefs: 00B62D26
l, xrefs: 00B62D50
l, xrefs: 00B62DE4
x, xrefs: 00B62CA7
s, xrefs: 00B62CE6
t, xrefs: 00B62D3B
r, xrefs: 00B62D34
c, xrefs: 00B62CD1
e, xrefs: 00B62CD8
i, xrefs: 00B62D2D
P, xrefs: 00B62CBC
r, xrefs: 00B62CC3
l, xrefs: 00B62DD6
r, xrefs: 00B62DBA
t, xrefs: 00B62DC1
t, xrefs: 00B62CB5
u, xrefs: 00B62DC8
a, xrefs: 00B62D49
i, xrefs: 00B62DB3
E, xrefs: 00B62CA0
e, xrefs: 00B62D65
s, xrefs: 00B62CDF
F, xrefs: 00B62D57
V, xrefs: 00B62DAC
W, xrefs: 00B62ED2
o, xrefs: 00B62DF2
A, xrefs: 00B62DDD
e, xrefs: 00B62D6C
l, xrefs: 00B62DEB
a, xrefs: 00B62DCF
r, xrefs: 00B62D5E

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID: A$E$F$P$V$V$W$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3159857985
Opcode ID: dcd060f2b06ed6305ffee57ec13170792041e393080db6e87252975db940b1eb
Instruction ID: d7a4b5ce684a4718be57592521d9b07385ed8501b152026b70a20e39ee107b74
Opcode Fuzzy Hash: dcd060f2b06ed6305ffee57ec13170792041e393080db6e87252975db940b1eb
Instruction Fuzzy Hash: 1312F651D186948EF7218724DC047EBBAB9EF91304F0480F9D48DAB682DA7E4FC58F66

Function 00B6368A Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8759796e577796facaf6410e267ecc8035756d30b6afbec0622172d954ae87d
Instruction ID: 1cfb3ea0ed4d7249d97a3d12669ff2be46dd61e8a2967468627138198f4070d0
Opcode Fuzzy Hash: a8759796e577796facaf6410e267ecc8035756d30b6afbec0622172d954ae87d
Instruction Fuzzy Hash: 3122CFB1D042289FEB24CB14DC91BEAB7B5EF95310F1481FAD849A7281D6395FC28F52

Function 00B6320D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeaabc50b8478343576f7d43f51f129f3718e76d7e43d5e774a63f5fe9aee434
Instruction ID: 71377a617d94a6ce0c54001f989a037554b03b6c8a1ab034b251a04ca9b7ae28
Opcode Fuzzy Hash: eeaabc50b8478343576f7d43f51f129f3718e76d7e43d5e774a63f5fe9aee434
Instruction Fuzzy Hash: 58B125A1D146549AF7208A24DC44BEBB6B6FF91300F1480FAD48C97681EB7E4FC58B62

Function 00B634A0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f7b90af2e24f8ce2308aff244a936ef98e9f01e9642d78f2a726421696d31c
Instruction ID: 0177a2cc041823987df8038d7d9a9c08ec369891472d8f42a172b89606c5af7b
Opcode Fuzzy Hash: b0f7b90af2e24f8ce2308aff244a936ef98e9f01e9642d78f2a726421696d31c
Instruction Fuzzy Hash: 83A101A2D142559AF7248B24DC51BFB77B9FF90300F1081FAD549AB680EA3D4FC18B66

Function 00B634EC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b0867116cadc11ea2067d58d00a66c4fc29d78b825471d5ff3bfb88011741d
Instruction ID: ed85097b76710acbc04a84d16dcab69376da4d54c9eba659059d8e62c5552b67
Opcode Fuzzy Hash: d4b0867116cadc11ea2067d58d00a66c4fc29d78b825471d5ff3bfb88011741d
Instruction Fuzzy Hash: 809124E2D146549AF7248B24DC51BFB76B9FF90300F1081FAD549A7680EA3D4FC28B66

Function 00B639BD Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6fa792b1912f2f3110fd454db437bafbf3aeee74cbd41c1b0d6967b679e8c8
Instruction ID: 7eba38612a692817848d499a0ae58ec23c9ab8db2f95899dffd6516670f7dbc8
Opcode Fuzzy Hash: 3e6fa792b1912f2f3110fd454db437bafbf3aeee74cbd41c1b0d6967b679e8c8
Instruction Fuzzy Hash: 429135A2D046549EF7248A20DC45BFB77B9FF81310F1481FAD48A96280EA7D5FC28F52

Function 00B657A5 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d069b9d7b16da0415a2d1832c5daefe866da1216cf529084f81449635d8c800
Instruction ID: 0e99312d994c5fd3aaabbd3a8e552355728c17615ed05f3975ff5fabe0b075fb
Opcode Fuzzy Hash: 0d069b9d7b16da0415a2d1832c5daefe866da1216cf529084f81449635d8c800
Instruction Fuzzy Hash: 69A1D1A1D146688AEB308B24DC45BFAB6B5EF94304F1040FAD44DA7680D6BD1FD5CF22

Function 00B63A0E Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d399c82c6a12d4f6c72a9048f00c750ffb3f2931bcacae6828448d38ebfe2210
Instruction ID: 612acefbed2a20545797fd2bdf54b81321aecf5f1674e9c466fa20f7570ad3b3
Opcode Fuzzy Hash: d399c82c6a12d4f6c72a9048f00c750ffb3f2931bcacae6828448d38ebfe2210
Instruction Fuzzy Hash: 5E8124A2D046549AF7248A20DC85BFB77B9FF81310F1481FAD44A96280EA7D5FC28F52

Function 00B63A13 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5fc2b5d51ac5ffe9548e6e122eb2dd87559f9c499f5375e1d4072e8e1234ae
Instruction ID: 213b27e383a55b3221ca0a1788fd4a176c0f6c6cda20344965d2ac70bced3691
Opcode Fuzzy Hash: ab5fc2b5d51ac5ffe9548e6e122eb2dd87559f9c499f5375e1d4072e8e1234ae
Instruction Fuzzy Hash: 4A8135A2D046549EF7248A20DC85BFB77B9FF80310F1481FAD44A96280EA3D5FC18F52

Function 00B63D85 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82641dfd62ca58f50e53c8acf19861619880ae17b7c2c260f78035f912ab585f
Instruction ID: cd40ccce82f287c65913c78771ccc49a0dba436e37e275933ae8ae0eb5730622
Opcode Fuzzy Hash: 82641dfd62ca58f50e53c8acf19861619880ae17b7c2c260f78035f912ab585f
Instruction Fuzzy Hash: D581F1A1D142549EF7248B20DC45BFB77B5FF90310F1081FAD489A6680EA3D5FC68B62

Function 00B63E4B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e22c99da476b7c77cc95c9a1f2b52eda69cf2a3aba7285967b08768fd99c1b1
Instruction ID: 2b18916e3eaee9dc45deaa35efd993a66aed29e7ed218eb16006da26560d8c79
Opcode Fuzzy Hash: 3e22c99da476b7c77cc95c9a1f2b52eda69cf2a3aba7285967b08768fd99c1b1
Instruction Fuzzy Hash: 5B81F0B1D146549FF7248A20DC45BBB77B5FB90300F1081FAD4499A680EA3D5FC68F62

Function 00B63C19 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120618b8a4666149ecc722cfc856d237991d556fe10dc10e99c42357060be524
Instruction ID: 0dfe9df1b349fb35aeec63220995b1848ee5fb7a2bd0331ac4f7ba48c2f77321
Opcode Fuzzy Hash: 120618b8a4666149ecc722cfc856d237991d556fe10dc10e99c42357060be524
Instruction Fuzzy Hash: F77112A1D146589EF7248A20DC45BBB77B9FF90300F1081FAD48996680EA7D5FC68F52

Function 00B63E59 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d18bdd210ec895769a0fea608248f1793c6cdb93721e6ef5b1108ff4ab1f5b
Instruction ID: 55ae834d33d291ea187d4bdc8e13d7f197e1a7160a5988c74994450bcb64ca70
Opcode Fuzzy Hash: 81d18bdd210ec895769a0fea608248f1793c6cdb93721e6ef5b1108ff4ab1f5b
Instruction Fuzzy Hash: EA81DFB1D146549FF7248A20DC45BAA77B9FF90300F1081FAE449AA680EA7D5FC68F52

Function 00B6363E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0985a087aaeb32bf2894781fc81adab1eb81101cf0be6f50efd8b9a91aa5d4
Instruction ID: ff62c66d155eece9f151b0220f7138f632911f154b9e5f9e6090fe216e98a591
Opcode Fuzzy Hash: 3f0985a087aaeb32bf2894781fc81adab1eb81101cf0be6f50efd8b9a91aa5d4
Instruction Fuzzy Hash: 686135A2D146549EF3148A20DC51BFB76B9FFD0300F1081FAD54D9A680EA7D5FC28B52

Function 00B63AD9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848f30189a2b4fa455d3c72dd6d10c6d9d7650873a0b83855ac0f11d987dc356
Instruction ID: 46eabfd8176bbcdf166cd5b1d729f58defb85dd538778e20a123473fae3e803c
Opcode Fuzzy Hash: 848f30189a2b4fa455d3c72dd6d10c6d9d7650873a0b83855ac0f11d987dc356
Instruction Fuzzy Hash: 1D6132A1D146449FF7148A20DC95BBB77B9FF80300F1481FAD18A9A281EA3D5FC28F52

Function 00B63AF7 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefa1a0f325faaae6eb2900124e158872a1933599bc86462fd7b7443ab591e7b
Instruction ID: 49f780befb34a992ed71f83e9907f47742916527ece5a6385227c74a5ce8b4a6
Opcode Fuzzy Hash: eefa1a0f325faaae6eb2900124e158872a1933599bc86462fd7b7443ab591e7b
Instruction Fuzzy Hash: AA5122A2D146549EF7148A20DC55BBB77B9FF90300F1091FAD18A9A280EA7D5FC28F52

Function 00B63EC3 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e583fccec61f1001fcc988bc35e34e963946d6a135528985ced1081b9e5c573
Instruction ID: fd85f425474cb98df2d6fc9c8e30c81e4dca9bb1c3ff3c8e98140092e3e059bc
Opcode Fuzzy Hash: 1e583fccec61f1001fcc988bc35e34e963946d6a135528985ced1081b9e5c573
Instruction Fuzzy Hash: 4B6101A1D146589EF7248A20DC45BBB76B9FF80300F1091FAD489A6680EB7D5FC28F52

Function 00B636F9 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834d8435e99213d0497d952cc4450a93481002b7e70251b5c095f081270f4590
Instruction ID: 03c8fbc9c1e08d324e7de0e5c5d8e3f062560003361fbb4534cd6f753985b617
Opcode Fuzzy Hash: 834d8435e99213d0497d952cc4450a93481002b7e70251b5c095f081270f4590
Instruction Fuzzy Hash: 5B5143A2D146548EF3148A20DC51BFB76B9FF90300F1091FAD5499B280EA7D5FC18B52

Function 00B63FB6 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63392d7e66651b7ecd2bcb9029b40aab18344b668e9d677f3b5d7c580fa0776
Instruction ID: e365dabbc6397e3e439d16aeee8444ccc09eca9b3f4574b02e3d49c5a5acbdb6
Opcode Fuzzy Hash: f63392d7e66651b7ecd2bcb9029b40aab18344b668e9d677f3b5d7c580fa0776
Instruction Fuzzy Hash: 65510FA1D146549EF7248A20DC51BAB76B9FF90300F10D1FAE0899A680EB3D5FC28F52

Function 00B63F91 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.405218571.0000000000B60000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_TRANSFERENCIA ACH NO 987685745658790976587465789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03583c977f6a526db178cce7d7193b9e277183a447421a9a47039c00d5245162
Instruction ID: 0ca00731fb97124b96e201b9e0ed6d4161a6f6244e3287363d268e2b6d2174e6
Opcode Fuzzy Hash: 03583c977f6a526db178cce7d7193b9e277183a447421a9a47039c00d5245162
Instruction Fuzzy Hash: 375100A1D146549EF7248A20DC51BAB76B9FF80300F10D1FAE0899A680EB3D5FC28F52

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\Music\ZentimoDesignerUpdater\ZentimoVideo.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
TRANSFERENCIA ACH NO 987685745658790976587465789.exe.exe

Function 00B9A239 Relevance: 107.8, APIs: 1, Strings: 60, Instructions: 1069
COMMON

Function 00BAA220 Relevance: 80.9, APIs: 1, Strings: 45, Instructions: 426
injectionCOMMON

Function 00B9B1C7 Relevance: 67.1, APIs: 1, Strings: 37, Instructions: 569
COMMON

Function 00B9B07E Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 494
COMMON

Function 00B9B036 Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 440
COMMON

Function 00B9B28E Relevance: 65.2, APIs: 1, Strings: 36, Instructions: 428
COMMON

Function 00B9B40E Relevance: 65.1, APIs: 1, Strings: 36, Instructions: 365
COMMON

Function 00B9B75C Relevance: 44.4, APIs: 1, Strings: 24, Instructions: 632
COMMON

Function 00BD0397 Relevance: 44.3, APIs: 2, Strings: 23, Instructions: 561
memoryCOMMON

Function 00B9B524 Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 423
COMMON

Function 00B9BC8E Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 377
COMMON

Function 00B9B4B3 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 352
COMMON

Function 00B9BBC0 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 344
COMMON